Coldcard’s five-year seed-generation flaw slipped past code reviews for a simple reason. The good random number generator was there, working, and being checked. It just was not the one making the wallets.
That gap, between verifying that a security component exists and verifying that production firmware actually calls it, is what Kraken chief security officer Nick Percoco says the hardware wallet industry has no process to close.
What Coinkite found in its own codebase
Coinkite disclosed on Thursday that the flaw dated to March 2021, when Coldcard integrated a new cryptographic library and inadvertently rerouted wallet seed generation to a weaker MicroPython pseudorandom number generator already sitting in the codebase, bypassing the device’s intended true random number generator.
The distinction between the two decides whether a wallet is secure. A true random number generator draws entropy from unpredictable physical processes in the hardware. A pseudorandom generator produces numbers from an algorithm, which can be reproduced by anyone who works out the starting conditions. Seeds built on the second kind are not stolen so much as recalculated.
‘The bulk of randomness on the COLDCARD was coming from a PRNG that I didn’t know was actually in the source code base,’ Coinkite said in its postmortem. ‘At the same time the carefully crafted TRNG code I wrote was being used, but just by chance, and only for less important things.’
That is a remarkable thing for a hardware wallet manufacturer to have to write. The correct code existed, was reviewed, and ran on tasks that did not matter, while the function the entire device is built to perform quietly used something else for five years.
Why nobody caught it
Because the intended generator was present and functional, reviews could confirm it existed and worked without ever establishing that the firmware shipping to customers was invoking it. Nothing in the process asked that question.
Posting on X on Sunday, Percoco called the incident a ‘wake-up call’ for hardware wallet manufacturers and argued that independent testing must verify the approved source of randomness is the one production firmware actually uses.
‘Consumers are asked to trust a manufacturer’s implementation of the single most critical function in the system, with no independent verification that the approved entropy path is the one actually executing,’ he said.
Standards exist, just not here
Percoco pointed to established standards mandating end-to-end entropy verification elsewhere, citing NIST SP 800-90B, the US government standard for designing, testing and validating physical true random number generators for cryptographic use, and BSI AIS-31, its equivalent from Germany’s Federal Office for Information Security.
‘Hardware wallets have no equivalent process. We have Common Criteria on secure elements, some CSPN certifications, and vendor-sponsored audits. None of them systematically force end-to-end verification that the validated entropy source is what production firmware actually calls,’ he said.
‘The payments industry does not let PIN entry devices ship without independent lab testing. The US government does not accept cryptographic modules without entropy source validation. Digital asset self-custody should not be the exception.’
His position is worth reading alongside where he works. Kraken is a centralised exchange, and an argument that self-custody hardware needs regulator-grade independent testing is not one an exchange has any commercial reason to resist. The substance stands regardless, since the standards he names are real and the gap he describes is exactly what Coinkite’s postmortem confirms.
What it cost beyond the stolen coins
As of Sunday, more than 4,500 addresses had been affected and close to $90 million in Bitcoin drained, with Galaxy Research continuing to identify new victims and the totals still provisional.
The wider effect shows up in a different number. Bitcoin transfers below 1 BTC reached 39,600 BTC in a single day on Friday, their highest daily level since November 2022, according to CryptoQuant head of research Julio Moreno. That was 300 BTC short of the 39,900 BTC moved on 16 November 2022, days after FTX filed for bankruptcy.
Small transfers are individual holders rather than institutions, so that figure is a direct measure of ordinary people moving their coins in a hurry. The last time it happened at this scale, the trigger was an exchange collapse that pushed people into self-custody. This time it ran the other way.
The self-custody argument is not settled
Not everyone reads it as a verdict on self-custody. Nick Neuman, chief executive of Bitcoin security firm Casa, pushed back on claims that self-custody is finished, arguing its distributed nature gave users time to react and estimating that perhaps ten times more Bitcoin was protected through self-custody than was stolen and identified in the attack.
Eric Balchunas, senior ETF analyst at Bloomberg, argued that Bitcoin exchange-traded funds offer a safer and more convenient route for many holders, pointing to the industry’s long operating record. Others countered that this was one manufacturer’s failure rather than a failure of the model.
Both readings survive the evidence. A single vendor’s build error emptied thousands of wallets, which is an argument for concentration risk in any one product. It is also true that the losses documented so far are single-signature, that multisignature holders were not affected, and that the flaw was found and publicised by independent researchers rather than concealed.
Coldcard halts shipments
Coldcard said on Sunday it has halted all device shipments since confirming the vulnerability on Thursday and destroyed all remaining units at its facilities running the affected firmware.
Coinkite has advised users with affected devices not to dispose of them, saying a device ‘may become essential if funds are recovered,’ and said its legal team would coordinate with law enforcement across multiple jurisdictions to support efforts to identify those responsible.
Bitcoin traded around $62,800 on Monday, little changed, with no sign the market has priced the incident at all.
