Over 50,000 Coldcard devices shipped with a deterministic RNG flaw. The code routed seed generation to a MicroPython fallback when a zero-valued feature flag was interpreted as “present.” That’s not a hardware failure. That’s a compile-time bug.
Coldcard is the Bitcoin maximalist’s weapon of choice. Air-gapped, open-source, no screens to leak. The brand built its entire narrative on “extreme security.” But when the random number generator (RNG) that creates your private keys is actually deterministic, the narrative collapses. The bug was discovered by Block’s security team, not by Coinkite. That’s the first red flag: the vendor missed it in internal testing. The fix was released on August 20 as firmware versions 5.6.1 (Mk4/Mk5) and 1.5.1Q (Q). But the math doesn’t lie: the fix is not retroactive. Any seed generated on affected firmware is potentially compromised.
Here’s the core mechanics. The RNG in Coldcard uses a hardware random number generator. But the code had a logical error: if a particular feature flag was set to zero, the system treated it as “defined” and routed the seed request to a deterministic MicroPython fallback. That fallback does not use hardware entropy. It uses a pseudo-random algorithm seeded with predictable values. The result: every seed generated on that path is identical for a given set of inputs. An attacker who knows the exact firmware version and device state can reconstruct the seed. No physical access required. Just the seed generation transaction. The scale is massive: every Mk2 and Mk3 unit, plus any Mk4 or Mk5 that was used with the vulnerable firmware before the update, is affected.
I’ve audited smart contract code for years. I’ve seen bugs that cost millions. But this one is different. It’s not about a flash loan or a reentrancy attack. It’s about the foundation of trust. A hardware wallet’s entire value proposition is that it generates true randomness. If the RNG can be tricked, the wallet is just a box of screws. The fix does not repair the RNG. It bypasses it. Coinkite’s solution is to force manual entropy: the user must roll a dice 50 times or flip a coin 128 times to generate the seed. The device then mixes that physical randomness with the internal RNG output. This is a workaround, not a cure. The underlying hardware RNG is still broken. The company is betting that bad human randomness is better than bad hardware randomness. That’s a dangerous bet.
The bug was in the code, not the chip.
Now, the contrarian angle. The market is panicking. Coldcard’s brand trust is evaporating. But the real story is not about Coldcard. It’s about the entire hardware wallet industry. Every hardware wallet relies on some form of RNG. Ledger uses a certified secure element. Trezor uses a software RNG with hardware entropy sources. But none of them are independently audited for RNG correctness at the code level. The industry standard is to trust the chip’s certification. Coinkite’s bug proves that the chip can be correct but the code can route around it. The fix is a band-aid; forcing manual entropy shifts the burden to the user. Most users will screw up the dice rolls. They’ll roll in a predictable pattern, or they’ll reuse the same dice, or they’ll record the results on a phone that’s connected to the internet. The human factor is the weakest link. The real solution is a hardware RNG that’s independently audited and failsafe—a chip that physically prevents deterministic fallback. But Coldcard didn’t do that. They added a workaround and called it security.
The fix is in the user, not the firmware.
This event also exposes the fragility of the self-custody narrative. “Hardware wallets are safe” is a mantra that’s been repeated for years. But this bug shows that safety is a process, not a product. The migration process is complex: generate a new seed on a different device, verify the addresses, move funds. One mistake and you lose everything. The cost of failure is high. The market is already pricing in the risk: second-hand Coldcard prices are dropping. Competitors like Ledger and Trezor are quietly updating their marketing to emphasize “audited RNG.” The real winners are the security audit firms. They’ll see a surge in demand for hardware wallet code reviews. The losers are the users who trusted the brand without verifying the code.
So what’s the takeaway? If you own a Coldcard Mk2 or Mk3, migrate now. Do not use the old seed. Generate a new one using the forced manual entropy process. But don’t assume the new seed is safe because you rolled dice. The protocol is only as strong as its weakest link. And right now, the user is the weakest link. The code is law, but math is the judge. This time, the math had a bug. The next time, it could be your chip. Stay skeptical. Verify everything. And never trust a random number generator that you can’t audit.
