Incident record · disclosed 30 July 2026

For more than five years, affected COLDCARD firmware created seeds without its hardware random number generator.

A COLDCARD is intended to create recovery words using the STM32 hardware random number generator on its main chip. In affected releases from March 2021 until fixes on 31 July 2026, a build-configuration error sent seed creation to a deterministic software generator instead. Seeds generated in that window can have far fewer possible values than intended.

How much fewer depends on the model. On Mk2 and Mk3 the software generator received no cryptographic entropy at all. On Mk4, Mk5 and Q a secure-element reseed carried at most 32 bits into it, one input among several rather than the whole of the remaining strength: Coinkite estimates about 72 bits of effective search space for those models, against the 128 bits intended.

About 594 BTC moved in the attributed 30 July sweep. After identifying a third wave on 1 August, Galaxy Research put the wider attributed total at 1,367.05 BTC across 4,585 addresses, and says it has not tested whether those addresses were in fact generated with low entropy. How much of that movement the flaw itself caused is not established from public evidence.

Start here

Are your coins affected?

Six questions at most. Your answers are processed by code running in your browser and are not transmitted. This site never asks for seed words, passphrases or extended private keys.

JavaScript is off

The interactive version needs it. The same logic is written out as a decision tree on Your risk, and the immediate classification is: a seed is affected if it was generated on a COLDCARD, on firmware from an affected firmware version. Pure dice generation starts from the rolls and bypasses the affected generator. Dice added to a device-generated seed are hashed into it, and Coinkite's advisory treats at least 50 fair, independent rolls that were never recorded or exposed as removing the risk from this RNG issue alone; fewer rolls, or any uncertainty about the count, the privacy of the rolls or which words you kept, leaves the seed in the affected group. Passphrases and multisig thresholds must then be assessed separately. See dice-generated and dice-mixed seeds for the conditions in full.

Protect recovery material

Do not disclose seed words to a website, form, support agent, email or message. Enter them only into an independently verified offline signer or recovery tool that you deliberately selected.

Checking exposure to this incident does not require the words, a passphrase, private keys or an extended private key. The relevant facts are the seed's original generation source, the model and firmware used at generation, and the dice workflow. Passphrase construction and wallet policy then affect the response.

A request to submit recovery material for an exposure check, support case or remote migration would expose key material and, where public wallet data is known, enable offline passphrase testing. Supplying enough signing material to meet the wallet policy would give the recipient spending authority. Deliberate recovery on verified offline equipment is a separate operation.

How to assess a request and respond to a disclosure →

Explore the incident

Six paths cover exposure, migration, firmware mechanics, the evidence record, the wider response and seed hygiene.

Your risk

Published attack-cost models and their assumptions, by configuration. Passphrases, multisig thresholds, dice, and the migration itself.

Plain language · no code 02

Moving funds

The ordered procedure for getting funds off an affected seed: verify the new wallet first, test, sweep, retire the old words. Multisig wallets get their own migration page.

Single-signature first · multisig linked 03

How it broke

The guard, the two generators, the truncated reseed, and how the fix works. Code claims cite checks against the source repositories.

Firmware detail 04

Evidence

134 snapshots across 59 sources, with diffs. Who said what, when they revised it, and what the earlier version said.

45 reviewed source changes · 74 detected differences 05

The response

What Coinkite, Block, independent developers and researchers said and shipped, the legal posture, and the evidence around claimed AI-assisted discovery and post-disclosure reproduction.

Vendor · community · legal 06

Seed safety

What never to do with recovery words during an incident, whoever is asking, and how to assess incident-themed requests that could expose recovery material.

Read before acting on any advice

How this is evidenced

This is an independent explainer and source archive. Material claims and claim groups state how they are known and link to their evidence. Advisories can change during an incident, so earlier versions are retained: 45 reviewed changes to published source content so far, across 59 sources, alongside 24 further detected differences reviewed as capture noise or collection corrections and preserved separately.