Following the disclosure of a severe low-entropy vulnerability in Coldcard hardware wallets — linked to publicly observed thefts that began on July 30 — Bitcoin holders are reassessing the trust assumptions underlying their self-custody setups. Attackers have exploited the flaw to brute-force private keys, resulting in the theft of over $100 million worth of BTC.

Coldcard, manufactured by Coinkite, has been widely regarded as one of the most security-focused hardware wallets in the Bitcoin ecosystem, marketed specifically for its air-gapped design and support for advanced features like multisig and PSBT workflows. The breach of that positioning has intensified scrutiny of how hardware wallet vendors implement and maintain their most security-critical code paths.

How the Coldcard Entropy Flaw Worked

Coldcard devices were equipped with STM32 "true random number generators" (TRNGs) designed to rely on physical processes to produce unguessable seed phrases. However, a critical vulnerability appears to have been introduced when Coldcard creator NVK initiated a firmware rewrite to transition the project from a GPL-licensed free software model to a read-only model.

Beginning with firmware version 4.0.1, released in March 2021, the devices used MicroPython's Yasmarang pseudo-random number generator (PRNG) instead of properly leveraging the STM32 hardware RNG. This deviation effectively bypassed the hardware-based entropy source. Random number generation remains a fundamentally difficult problem in computer science, which is why the creation of secure, unguessable private keys must always rely, at least in part, on external physical processes. The move away from GPL licensing also reduced the ability of independent developers to audit firmware changes in real time — a tension the open-source hardware wallet community has long flagged as a systemic risk.

Analysts widely characterized the use of Yasmarang as a pre-programmed fallback. Coinkite, the manufacturer behind Coldcard, disputed this characterization in a recent X post.

The possibility that Coldcards defaulted to an obviously insecure seed generation method fueled speculation on X about whether the flaw was an intentionally placed backdoor. Investigative Bitcoin journalist Hodlnaut speculated that the bug originated from careless development practices and attempts to suppress errors through arbitrary code changes.

According to Coinkite's own estimates, Mk2 and Mk3 devices generated seeds with only approximately 40 bits of entropy, while the Mk4, Mk5, and Q models achieved around 70 bits. Both figures fall far short of the 128 bits required for a secure 12-word seed phrase.

Related: Coldcard hackers transfer 64 BTC and 200 ETH to cryptocurrency mixers

The likelihood that a given wallet could be compromised depended on whether the user had added supplemental dice entropy, or employed a BIP-39 passphrase combined with a non-standard derivation path.

James O'Beirne subsequently launched cktripwire, a website deploying honeypot addresses designed to identify which wallet configurations attackers are actively sweeping.

Coinkite has also published an official seed generation warning for affected devices.

How Physical Entropy Protected Some Wallets

The Coldcard exploit has starkly reinforced one of the Bitcoin community's foundational tenets: don't trust, verify.

Users who declined to rely on an opaque hardware component for entropy generation at the most security-critical stage — instead using a sufficient number of physical dice throws — were shielded from the exploit entirely. Rolling dice is a simple, visibly transparent process that any ordinary user can audit and intuitively understand. Verifying a TRNG, by contrast, would require detailed physical inspection of the device's electronics and a thorough examination of its firmware.

While some commentators have cited recent events as evidence that self-custody is fundamentally flawed, adhering to entropy best practices leaves very few avenues for a remote attacker. When a seed phrase is generated through physical entropy rather than hardware-dependent processes, the single most critical point of failure in wallet creation is eliminated.

The extended public key (xpub) and receiving addresses derived from the seed can be cross-verified by importing the seed into multiple independent devices. Nonce exfiltration across an airgap can also be detected by confirming that two devices produce identical RFC 6979-compliant signatures when processing the same unsigned transaction.

Secure entropy generation is thus the absolute prerequisite for a safe wallet. Since the Coldcard exploit became public, various methods and proposals for trustworthy entropy generation have circulated widely on X.

The most popular approach involves cross-checking the device's ability to correctly convert die faces into a BIP-39 seed phrase by applying a SHA-256 hash. Using upwards of 100 dice throws generates sufficient entropy for a 24-word seed.

Simpler paper-based methods, such as the lookup table published by Bitbox, partition the BIP-39 word list so that a combination of six dice rolls and a coin flip can be directly mapped to a seed word without any electronic device.

More advanced tools, such as the codex32 dice de-biasing worksheet, employ a von Neumann extractor — a procedure computable entirely by hand — to produce a secure seed phrase even with biased dice.

An alternative to dice involves printing the full BIP-39 word list, cutting the words into uniform paper slips, shuffling them thoroughly, and drawing 24 words at random. Products such as Seedsticks or Entropia offer more convenient and durable implementations of this method.

Specialized hardware such as Frostsnap attempts to verifiably distribute entropy generation across multiple devices. Some users have even begun designing their own physical entropy instruments capable of producing seed phrases nearly as quickly as a dedicated electronic wallet.

Magazine: Do the Coldcard attacks mean all hardware wallets are now insecure?