BTC.TedLee.ca · Bitcoin Security
A white-hat explanation of the 2026 COLDCARD random-number flaw—and a practical guide to reducing the chance that your Bitcoin is stolen.
Urgent security notice · Updated August 2, 2026
Do not assume that updating the firmware fixes your existing wallet
If an affected firmware version generated your seed words, the seed may remain predictable forever. A firmware update fixes future seed generation; it cannot add randomness to seed words you already have.
The safe response is to create a completely new seed with fixed firmware and move the Bitcoin to addresses derived from that new seed. If you are uncertain about your model, firmware, dice rolls, or passphrase strength, treat the old seed as at risk.
Case study
A hardware wallet is meant to create a seed from high-quality randomness. That seed controls the private keys that can spend your Bitcoin. In affected COLDCARD firmware, a software integration error caused seed generation to reach a predictable fallback pseudorandom-number generator instead of the intended hardware random-number generator.
These are evolving on-chain estimates reported by CoinDesk from Galaxy Research as of August 2, 2026. Blockchain analysis can observe transfers, but it cannot by itself prove the identity or intent behind every transaction.
The supporting libNgU code checked whether MICROPY_HW_ENABLE_RNG was defined, not whether it was enabled. COLDCARD defined it as zero. The build succeeded, but the wallet silently used MicroPython’s deterministic Yasmarang fallback.
The attacker did not need to steal or connect to a hardware wallet. If the possible seed space can be reproduced offline, public Bitcoin addresses provide a way to test candidate keys and identify funded wallets.
Coinkite says earlier review confirmed that the intended random-number code existed in the firmware binary, but did not verify the complete path and symbol resolution from wallet seed generation through two software submodules.
Open source makes inspection possible; it does not prove that the most important paths were fully audited. Security needs end-to-end tests, independent review, reproducible builds, and continuing scrutiny.
A seed phrase can look long and random while having far fewer possible origins than expected. Hashing weak input or displaying it as 24 words does not create new entropy. Coinkite’s preliminary estimates were about 40 bits for affected Mk2/Mk3 seed generation and about 72 bits for pre-fix Mk4/Q/Mk5 seed generation.
Bar lengths are a visual comparison of bit counts, not a linear measure of brute-force time. Each extra bit doubles the theoretical search space.
Check the firmware that created the seed
| Model / track | Seed-generation versions at risk | Fixed version for new seeds |
|---|---|---|
| Mk2 / Mk3 | 4.0.1 through 4.1.9 | 4.2.0 or later |
| Mk4 / Mk5 standard | Before 5.6.0 | 5.6.0 or later |
| Q standard | Before 1.5.0Q | 1.5.0Q or later |
| Mk4 / Mk5 Edge | Before 6.6.0X | 6.6.0X or later |
| Q Edge | Before 6.6.0QX | 6.6.0QX or later |
Exposure depends on the firmware running when the seed was generated, not the firmware installed today. Mk1 is outside this regression. Coinkite says TAPSIGNER, OPENDIME and SATSCARD use different codebases and are not affected by this bug.
Dice-roll exception—only if you are certain
Coinkite says the flaw does not remove entropy that a user added through COLDCARD’s Add Dice Rolls process. At least 50 fair, independent and private rolls contributed at least 128 bits; 99 or more contributed about 256 bits. If you used fewer than 50, cannot remember, recorded the rolls, or let anyone see them, migrate to a new seed.
A BIP-39 passphrase helps, but it is not a repair
A strong, unique BIP-39 passphrase adds a separate barrier. A short quotation, reused phrase, predictable pattern, or dictionary words may be guessed. The device PIN is not the BIP-39 passphrase. Coinkite still recommends migrating affected passphrase wallets to a new seed.
Practical defence
If Bitcoin has already moved without your permission
Look for named third-party audits, reproducible-build instructions, published threat models, responsible-disclosure programs and a history of fixing vulnerabilities—not simply the words “open source.”
When supported and properly documented, verified physical dice can reduce reliance on a device RNG. Never photograph, type, scan or paste seed words or dice results into an online device.
For life-changing amounts, a properly tested 2-of-3 multisignature wallet can prevent one weak seed from being enough. Use different vendors or codebases and independent seed-generation sources. Multisig adds backup, inheritance and recovery complexity, so expert help may be worthwhile.
Before depositing a large amount, test a small receive, a spend, and a full recovery. Confirm addresses on the hardware display and document a clear inheritance plan that does not expose the keys today.
Subscribe to the manufacturer’s official security notices. Read release notes before updating, but respond quickly to an active seed-generation advisory.
Do not keep every satoshi behind one seed, one device, one backup location or one person’s memory. The right level of separation depends on the amount and your ability to manage complexity safely.
White-hat view
AI can help, but it cannot certify that a wallet is safe. The best defensive workflow combines human cryptography expertise, conventional static analysis, dependency scanning, compiler and linker checks, fuzzing, hardware tests, reproducible builds and AI-assisted review.
AI does not magically break sound cryptography. In this case, the weak randomness—not Bitcoin’s cryptography—made offline searching practical.
Why this bug is a good AI-review test case
At a glance, the intended hardware RNG existed and the code compiled. A useful reviewer had to ask a deeper question: Which implementation does wallet seed generation actually reach in the production build? An AI assistant could help follow that path and question the macro, but only if it had the complete build context and its findings were verified by experts and tests.
The discovery also changes the economics of wallet research. Once attackers know that one overlooked bug can expose valuable wallets, AI makes it cheaper to examine many repositories, dependencies and historical commits. Defenders can use the same scale to audit first, add regression tests and review every security-critical build path. It is an ongoing race—not an automatic victory for either side.
The hardest failures still need skilled humans: cryptographic implementation mistakes, race conditions, hardware behaviour, side channels and business-logic assumptions can all defeat a plausible-looking AI review. AI findings should become hypotheses for experts and tests, not declarations of safety.
A 2026 academic study of third-party LLM API routers found malicious code injection, access to researcher-owned credentials and one router that drained ETH from a researcher-controlled private key. That does not mean all AI services are malicious. It means developers should treat intermediaries, plugins and autonomous coding agents as security boundaries.
The OpenSSF guidance is blunt and sensible: the developer remains responsible; AI-generated code still requires testing, static analysis, dependency checks and human code review.
Easy mistakes to avoid
Please read
Education—not a guarantee or professional instruction
This page is for general educational and cybersecurity-awareness purposes only. It is not financial, legal, forensic or individualized security advice. The COLDCARD investigation is evolving; affected-version details, loss estimates and technical conclusions may change after publication.
Moving Bitcoin and changing a custody setup can itself cause permanent loss. Verify all instructions against current official advisories, test with a small amount, and consider qualified professional help for substantial holdings, multisig, estate planning or incident response. TedLee.ca is independent and is not affiliated with or endorsed by Coinkite, Block, Galaxy Research or the other cited organizations.
Sources checked August 2, 2026
Continue exploring