Coldcard's Offline Lie: How a Silent RNG Regression Turned Self-Custody into a 4-Billion Guess Game

We didn't see this coming. I didn't—despite years spent auditing the same primitive that underpins blockchain security. Coinkite, working with Block's bitcoin engineering team, disclosed late Wednesday that a firmware regression in Coldcard hardware wallets has silently disabled secure random number generation since first appearing in 2021. Seeds generated after that update carry so little entropy that private keys can be guessed across roughly 4 billion combinations—a range modern GPUs can sweep in seconds to minutes. Attackers have already moved with terrifying efficiency, draining at least 594.48 BTC, worth approximately $38.3 million at current prices. Let that number settle. This is not a phishing scam. It is not a compromised exchange hot wallet. It is a hardware wallet—the category that sold itself as the final fortress of bitcoin self-custody—whose cryptographic foundation turned out to be guessable. The industry has spent years telling users to buy hardware, verify the seal, write down the seed phrase, and sleep soundly. Coldcard was the gold standard for that promise: open-source firmware, air-gapped signing, a device built by bitcoiners for bitcoiners. It was the wallet you recommended when you wanted to prove you took self-custody seriously. Now the fortress has a back door that was never locked. The technical story is both simple and brutal. Coldcard devices rely on a hardware TRNG—a true random number generator—to produce the entropy that seeds BIP39 mnemonic phrases and derives BIP32 keys. A firmware update released in 2021 introduced a regression that effectively disabled this TRNG. Instead of generating unpredictable bytes, the device fell back to a predictable combination of serial numbers and clock values. The random generator check that should have caught this failure was itself broken. The result: private keys that should have lived in a 2^256 key space collapsed into roughly 2^32 possibilities. For those who prefer concrete numbers, that is about 4.29 billion. A PlayStation can brute-force that in an afternoon. A dedicated GPU rig can do it in minutes. I have spent the last several years analyzing exploits where the attack vector was hidden in plain sight. In 2022, I found a reentrancy vulnerability in Aura Finance's staking contract that several major audit firms had missed. I remember staring at the transaction flow, then at the audit report, and realizing the auditors had verified the code paths they expected to see, not the ones an attacker would actually use. This Coldcard situation feels eerily familiar. Somewhere in 2021, a developer changed a configuration, disabled secure entropy, and the QA process—if it ran at all—failed to ask the one question that mattered: is this device actually producing random numbers? That failure persisted for nearly five years. Five years of firmware releases, five years of security reviews, five years of community confidence built on a foundation that was quietly rotting. The attack itself is even more worrying because it did not require physical access to the device. Once a Coldcard user derived a receiving address from a weak seed, that address became a target. The attacker could scan the blockchain for addresses derived from Coldcard-generated seeds, derive the corresponding private keys by brute-forcing the 4-billion-combination space, and sweep the funds. No malware on the user's computer. No stolen seed phrase. No physical theft. Just mathematics working exactly as intended—except the mathematics was configured by a faulty firmware update. The address you publish to receive bitcoin is effectively a public key. When the entropy behind that key is weak, the private key is nothing more than a needle in a haystack that a GPU can sort in real time. It is no coincidence that this echoes the Ill Bloom vulnerability reported earlier this year, where weak seed phrases were used to drain wallets. The pattern is consistent: the crypto ecosystem has a blind spot for entropy. We audit smart contracts until we are blue in the face. We fuzz transaction parsers. We test signing implementations. But we rarely verify that random number generators are actually random. We assume the hardware vendor checked that. We assume the chip manufacturer's TRNG is trustworthy. We assume the firmware update did not break the one thing that makes all other cryptographic guarantees possible. Those assumptions are exactly what this event destroys. Coldcard's official advisory claims that Mk4, Q, and Mk5 devices are not affected, based on what they call "early analysis." That phrasing should make every security-conscious user pause. Early analysis is not final analysis. The affected range could expand as investigators dig deeper into the git history and chip-level behavior. I have seen too many incident reports where the initial scope statement turned out to be incomplete. The only safe move right now is to assume the scope could widen and act accordingly. What makes this worse is that a firmware update cannot fix the damage. Once a seed has been generated with weak entropy, the private keys derived from it are permanently compromised. You cannot patch them. You cannot rotate them in place. You must generate a new seed on updated hardware, transfer your funds to a fresh wallet, and then retire the old device forever. This is a slow, expensive, and—for non-technical users—deeply stressful process. But it is the only process that works. If you are a Coldcard user, and especially if you own an Mk3 running firmware after version 4.0.1, you should not wait for the investigation to conclude. You should migrate now. The market impact is more nuanced than a simple selloff. Bitcoin itself will not crater because of a $38 million theft. That amount is a fraction of daily trading volume and barely moves the needle. But the psychological impact on the self-custody narrative could be significant. For years, the industry told users: not your keys, not your coins. The logical extension of that slogan is that you need a hardware wallet to protect those keys. Now a leading hardware wallet has proven that the device itself can betray you. Users who were already nervous about the complexity of self-custody may decide that regulated custodians or multi-signature setups are worth the trade-off. This is not a death blow to hardware wallets, but it is a serious crack in their armor. Competitors are already circling. Ledger and Trezor will likely capitalize on this moment with marketing that emphasizes their independent RNG certifications and audit processes. Multi-signature setups, which distribute trust across multiple signing devices, will look increasingly attractive to sophisticated users. Block, which participated in the investigation through its bitcoin engineering team, also sells its own hardware wallet—Bitkey. That participation raises an uncomfortable question. How independent is an investigation when one of the investigators benefits from the other company's failure? I am not accusing anyone of misconduct; there is no evidence of that. But the conflict of interest is structural, and it deserves attention. The final scope of affected devices should be verified by independent researchers, not just by the vendor and its competitor-investor. Let me step back and explain why this matters beyond Coldcard itself. Hardware wallets are not the only place where this class of failure lives. Look at Layer 2 sequencers: for years, the industry has accepted that a single sequencer—effectively a centralized node—orders transactions for an entire rollup, and we call it "decentralized" because the tech stack theoretically allows for multiple sequencers. Similarly, bitcoin mining has consolidated to the point where a handful of pools control the majority of hash power. We accept these single points of failure because they are convenient and because nothing catastrophic has happened yet. RNG failures are the same. We accept the assumption that hardware vendors handle entropy correctly because questioning it is inconvenient. This event is what happens when an assumption we should have questioned years ago finally breaks. The deeper lesson is about verification. Cryptographic security is not a one-time property you purchase with a hardware wallet. It is a continuous process. A device that produces valid signatures today can produce catastrophically weak keys tomorrow, not because the algorithms changed, but because the entropy source was silently corrupted. The industry needs a new standard: entropy that is provably random, not merely claimed to be random. This could take the form of publicly verifiable random beacons mixed into the seed derivation process, or open-source self-tests that run at every boot and log their results, or chain-visible proofs of key generation. Some hardware vendors are already exploring these ideas. This incident will accelerate that work. Regulation didn't anticipate this. Consumer product safety regimes like the CPSC in the United States and the EU's GPSR focus on physical harms and basic device safety. They do not have the technical capability to verify whether a random number generator in a firmware update is doing its job. Even the crypto industry's own audit culture, which has matured significantly since the DeFi hacks of 2022 and 2023, has not developed reliable tooling for RNG verification. We can prove that a smart contract does not have reentrancy. We struggle to prove that a hardware wallet actually generates 256 bits of true randomness. That gap is the real scandal. It is also the real opportunity. The first company to ship a hardware wallet with independently verifiable entropy generation will have a significant market advantage, not just in reputation but in actual user trust. I keep coming back to a conversation I had in early 2024, when the bitcoin ETF approval was approaching and the narrative was almost comically bullish. I argued that ETF inflows could hurt long-term decentralization by consolidating custody in traditional finance arms. The pushback was fierce. People accused me of being contrarian for the sake of it. But my point was not that ETFs were bad; it was that we were making a trade-off without fully acknowledging the concentration risk we were accepting. This Coldcard situation is the same pattern in a different form. Users accepted the trade-off of trusting hardware firmware because it seemed safer than hot wallets. They did not realize the firmware itself could become a single point of failure. The lesson is not that hardware wallets are worthless. The lesson is that every layer of the stack needs independent verification, and the industry has been dangerously lazy about verifying the entropy layer. What should you do right now? If you are a Coldcard user, check your firmware version. If it is newer than 4.0.1 on an Mk3, assume your seed might be compromised. Generate a new seed using updated hardware, move your assets in two steps—first a small test transaction, then the full amount—and then securely destroy the old device. Do not let the convenience of waiting outweigh the risk of staying. The attackers are almost certainly running automated scans across affected address ranges already. Every hour you delay is a chance for the haystack to get smaller. If you are not a Coldcard user, the takeaway is still urgent. This is a warning shot at the entire self-custody ecosystem. The promise of "cold storage" is not that the device is offline—it is that the private keys are unpredictable. This event proves that a device can be fully offline and still generate keys that an attacker can predict. The threat model we all internalized is incomplete. We need to add a new requirement to our security checklist: entropy verification. How do you prove that your hardware wallet generated its seed with true randomness? If you cannot answer that question, you have not fully secured your assets. The narrative around hardware wallets is shifting from "buy one and forget it" to "buy one and audit it regularly." That shift is uncomfortable, but it is necessary. The industry has treated hardware wallets as black boxes of security for too long. Coldcard was supposed to be the most transparent black box of all, with open-source firmware and a community of hardcore bitcoiners scrutinizing every release. If that scrutiny did not catch a five-year entropy failure, what hope do closed-source vendors have? The answer is that none of us can afford to rely on hope. We need standards. We need independent audits. We need chain-visible proof that our keys were born from actual randomness. The question I keep asking myself is simple: what else have we been trusting without verification? Somewhere, right now, another critical security assumption is probably failing in silence. It could be in a chip manufacturer's library. It could be in a sequencer's transaction ordering. It could be in a mining pool's block selection algorithm. We will not know until the first exploit lands. The only defense is to stop trusting assumptions and start demanding proof. Verifiable randomness is not a niche technical concern—it is the foundation of every private key in existence. When that foundation cracks, everything built on top becomes sand. The 4.29 billion possibilities that Coldcard's weak entropy created are not just a vulnerability. They are a mirror held up to an industry that has confused convenience with security, and brand reputation with cryptographic guarantees. The answer is not to abandon self-custody. It is to rebuild it on foundations that can be verified rather than merely trusted. The next generation of hardware wallets will need to show their work. The rest of us will need to demand it.