Empty-PIN factory reset enabled a supply-chain attack on the Coldcard

On 12 May 2020 the researcher sedited (TheCharlatan) published a supply-chain attack on the Coldcard, then the Mk2/Mk3. He had reported it to Coinkite beforehand and says Coinkite acknowledged the issue and agreed to publication, but provided no fix or bounty.

According to the write-up, changing an existing main PIN to an empty PIN returns the device to its blank, unused state, although Coinkite had said a factory reset was impossible. Someone handling the device before the buyer, such as a reseller or an intercepted shipment, could load modified firmware (Coldcard allows unsigned firmware by design), clear the PIN so the device looks new and keeps its original bag number, and for example plant a root private key the attacker controls. The researcher says the warning shown on first run of unsigned firmware does not appear for the buyer, that the tamper-evident bag can be cut and resealed with household tools, and that the attack is cheap and scalable.

The researcher writes that Coinkite responded in a blog post on 17 May 2020, describing the attack as part of its original threat model and presenting a firmware update as the mitigation; he disputes that this is complete, because the immutable bootloader cannot be patched on devices already sold. Coinkite’s disclosure history says it emphasised firmware verification and first-use checks, and lists the status as mitigation disputed, with no retrofit to the immutable bootloader.