On August 20, Coinkite released a firmware update that forced every Coldcard user to roll dice or flip coins. This wasn't a feature. It was a confession. The confession: the hardware random number generator (RNG) in your Coldcard—the device you trusted to generate your private keys—could fail silently, producing deterministic seeds that an attacker could predict. The fix? Don't trust the hardware. Trust your hands.
This is not a story about a bug. It's a story about the fragility of the entire hardware wallet security model. And it's a story that every Bitcoin holder needs to read, because the migration path is treacherous, and the industry's response will shape the next decade of self-custody.
The Context: What Coldcard Is and Why RNG Matters
Coldcard, made by Coinkite, is a Bitcoin-only hardware wallet that has built its reputation on extreme security. It's the device of choice for bitcoiners who demand air-gapped signing, open-source firmware, and a level of paranoia that borders on the obsessive. Its users are not casual investors; they are the security-conscious elite who understand that a hardware wallet is only as secure as its weakest component.
And the weakest component, it turns out, is the random number generator. Every private key, every seed phrase, every address is derived from randomness. If the RNG is flawed, the keys are predictable. An attacker who knows the RNG output can generate your private key and drain your funds without ever touching your device. This is not theoretical. It has happened before, in other wallets, with devastating consequences.
The vulnerability in Coldcard was discovered by Block, the payments company led by Jack Dorsey, which has been conducting an independent security analysis of Coldcard's firmware. Block's analysis found that under certain conditions, the code could route entropy requests to a deterministic MicroPython fallback, because a feature flag that was defined as zero was treated as present. This is a classic code logic error—not a hardware design flaw—but the impact is catastrophic. The RNG would produce the same output every time, or at least a predictable sequence, for any user who triggered that code path.
Coinkite responded quickly. Within days, they released firmware updates for all affected models: Mk4 and Mk5 got version 5.6.1, and the Coldcard Q got 1.5.1Q. The update forces users to generate their seed using physical randomness—rolling dice or flipping coins—instead of relying on the hardware RNG. This is a radical departure from every other hardware wallet on the market, which still trusts the chip's RNG.
The Core: The Fix, The Migration, and The Unaddressed Root Cause
Let's be precise about what the fix does and doesn't do. The new firmware does not repair the underlying RNG defect. It bypasses it. When you create a new seed, the device now requires you to enter 50 dice rolls or 128 coin flips, which are mixed with the hardware RNG output to produce the final seed. This is a defense-in-depth strategy: even if the hardware RNG fails again, the physical entropy you provide ensures the seed is still unpredictable.
But here's the uncomfortable truth: this fix is not retroactive. If you already have a seed generated on an affected firmware version, the new firmware cannot add entropy to that seed. The only way to be safe is to generate a completely new seed and migrate all your funds. That means moving every bitcoin, every satoshi, to a new wallet address. For a hardware wallet user, this is a high-stakes operation. One mistake—a misread address, a lost backup, a failed test transaction—and your funds are gone forever.
Coinkite has published a detailed migration guide, and they've been transparent about the process. But transparency doesn't reduce the risk. The guide requires users to verify the new seed, test with a small amount, and then move the rest. It's a process that can take hours, and it's fraught with opportunities for error. Based on my experience auditing hardware wallets, I can tell you that most users will not execute this perfectly. They'll skip the test transaction, or they'll misplace the dice roll record, or they'll accidentally reuse an old address. The migration is a minefield.
And what about the root cause? The code logic error that caused the RNG to fall back to a deterministic path—why wasn't it caught in testing? Coinkite's internal QA should have included fault injection and fuzzing on the RNG path. The fact that it didn't suggests a systemic gap in their testing methodology. The firmware update also includes other security improvements: USB review, PSBT validation, SIGHASH_SINGLE restrictions, and a persistent RNG failure stop. These are good, but they're band-aids on a deeper wound.
The Contrarian Angle: The Fix Is a Workaround, Not a Cure
Here's what the mainstream coverage is missing: the fix shifts the security burden from the hardware to the user. Coinkite is now asking you to trust your ability to roll dice fairly, privately, and independently. But humans are terrible at randomness. We have biases. We drop dice. We lose count. We get distracted. The new model assumes that a user can correctly perform 50 dice throws or 128 coin flips without error, and that the process is not observed by anyone. That's a stronger assumption than trusting a well-designed hardware RNG.
Moreover, the fix only applies to seed generation. What about other operations that rely on the RNG? The firmware update includes a "persistent RNG failure stop" and a "startup hardware RNG link check," which suggests that the hardware RNG itself may have intermittent issues. If the RNG can fail during seed generation, it can fail during transaction signing, or during the generation of nonces for ECDSA. A predictable nonce is a catastrophic vulnerability—it allows an attacker to recover your private key from a single signature. Coinkite has not addressed this. They've only patched the seed generation path.
This is the uncomfortable truth: the fix is a workaround, not a cure. The underlying RNG is still suspect. The new firmware adds checks and fallbacks, but it doesn't replace the hardware RNG with a proven, audited component. The industry's narrative of "hardware wallets are safe" has been shattered. And the response from Coinkite, while swift, has not been fully transparent. They have not yet disclosed the number of affected users or the total losses. Block's analysis boundary was broader than Coinkite's, which suggests that Coinkite may have underestimated the scope of the problem.
The Takeaway: A New Era of Hardware Wallet Security
This event is a watershed moment for the hardware wallet industry. It proves that no device is immune to RNG failures, and that the trust model must evolve. The art is the hash; the value is the proof. We do not build for today. We build for the long term, and that means we must demand more from our security tools.
Going forward, every hardware wallet manufacturer should be required to submit their RNG implementation to independent, third-party audits. The code should be open-source, and the testing should include fault injection and statistical analysis. Users should be educated about the risks of RNG failures and the importance of physical entropy. And the industry should establish a standard for RNG transparency, similar to the way that cryptographic libraries are certified.
For Coldcard users, the immediate action is clear: check your firmware version, and if you're affected, migrate your funds immediately. Do not delay. Do not skip the test transaction. And when you generate your new seed, treat the dice rolls with the same care you would treat a surgical procedure. The reentrancy of this vulnerability doesn't care about your deadlines. It cares about your diligence.
This is not the end of Coldcard. Coinkite has a strong reputation, and their response has been better than most. But the trust deficit will take years to repair. And for the rest of us, this is a reminder that security is not a feature—it's a process. The block confirms everything, even your mistakes. Make sure your next seed is not one of them.