ICYMI Python on Microcontrollers Newsletter: CircuitPython Day Announced, MicroPython TV, a Hack and More!

A significant security vulnerability in Coldcard, a hardware Bitcoin wallet running MicroPython-based firmware, exposed wallets to theft. On July thirty-first, attackers exploited an insecure random number generator to drain nearly five hundred ninety-four Bitcoin—worth thirty-eight point three million dollars—from approximately five hundred single-signature addresses. Rather than use MicroPython's built-in hardware random generator, Coldcard had substituted its own implementation, which relied on just two predictable inputs: the device's serial number and its internal clock. A cryptography library in the firmware failed to verify that the random source was actually random. As Adafruit Blog reports, this represents an application-level bug in Coldcard's software, not a flaw in MicroPython itself—a stark reminder of why security defaults exist.

Listen to this story

Hear this and more stories in a personalized audio briefing.

Open The Chonkerton