COLDCARD RNG incident the public record, collected and explained
Informational only, and this site never asks for your seed words. details

Informational only. This is an open source collection of what others have published about the incident, together with an explanation of it. It is not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite. Material is attributed and quoted as published; where sources disagree their scenarios are kept separate with their assumptions rather than reconciled into one answer. Everything is meant to be checked against the linked evidence rather than taken on trust. Act on your own judgement about a particular situation. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it, and contributions containing recovery words or private keys are not accepted.

Plain language Updated 15 Aug 2026

Source change record

The newest activity in one searchable stream. Older revisions remain on their source pages and in the complete structured change feed.

Newest first, one stream. The filter below defaults to the reviewed source-content changes: a reviewed source-content difference means the relevant text served by the publisher changed between two captures. It does not verify the new claim. Collection differences (dynamic page chrome and collection-method corrections), first captures, registered posts and the operational log (baselines, fetch errors, blocked and skipped checks) remain part of the record one click away. Chain-monitor diff bodies remain local because they can contain victim addresses.

Some states here were not collected by this project. Where a difference involves a page state recovered from the Internet Archive, the entry carries an Internet Archive mark: on the later state when that state was inherited, and as a baseline note when the text being revised was the inherited one. 24 of the 1797 recorded differences carry one of those marks, counted at build time from the same data this page lists rather than stated as of a date somebody has to remember to change. This keeps a recovered state from reading as a change this project caught live.

This record is part of the evidence section, which lists every tracked source and what is held for it. To follow detected differences without revisiting the page, the complete revision series is published as a JSON feed at /record/changes.json, carrying each bounded revision window and its provenance flags. First captures, registered social posts and poll diagnostics are not part of that feed.

1279reviewed source changes
0awaiting review
518collection differences
3593baselines and errors
Show
Source

Search covers the newest 240 of 6762 activity entries. 6522 older entries remain available on individual source pages; all 1797 detected differences are in the JSON change feed.

August 2026

  1. Relationship-enrollment bug in Bitkey capture noise +0 -1

    bitkey-relationship-enrollment-report · Block / vendor-response

    The trailing page-title line Relationship-enrollment bug in Bitkey | Bitkey toggled off again; the report body was unchanged.

    -Relationship-enrollment bug in Bitkey | Bitkey
  2. Full panic - one of my wallets was drained source content +0 -10

    reddit-full-panic-drain-report · r/Bitcoin / victim-account

    The thread lost a comment by Aflockofants arguing that Bitcoin has become a get-rich-quick scheme for wealthy Westerners.

    -
-comment: p0poz41
-parent: t1_p0occls
-author: Aflockofants
-created_utc: 1785433688
-edited: false
-body:
-Yet when Bitcoin defenders talk about Bitcoin, it’s almost always mixed with some bullshit about how it will give poor people a chance, all kinds of initiatives in the developing world, yadayadayada. Just admit that by now it’s a get-rich-quick scheme for people in the Western world that have some money surplus.
-
-I’ve been a software developer for over 30 years and even mined some Bitcoin with my own PC back when that was still viable. I’m fully aware of how most people won’t be able to fully secure their own wallets. You’re never gonna be able to defend this idealistic story on how it will change the world and will protect us from tyrannical governments, while at the same time claiming people are morons for not being able to secure their own wallets. I took off when I saw that all the idealistic nonsense was just that: nonsense. To justify this whole thing where a few people are getting outrageously rich.
  3. The Missing 153: what followed the Wave 1 reconstruction entered the record

    Praveen Perera's follow-up to his Wave 1 key-reconstruction work: what he tried against the final 153 unreconstructed addresses, checked against the published Galaxy victim lists…

  4. The Missing 153: what followed the Wave 1 reconstruction baseline
  5. r/Bitcoin: returning the COLDCARD device and asking for a refund entered the record

    reddit

  6. r/Bitcoin: returning the COLDCARD device and asking for a refund baseline
  7. COLDCARD hack tracker source content +8 -0

    coldcard-hack-tracker · community tracker / chain-monitor

    The tracker added a new Hop 1 movement of 0.241352 BTC from the Aug 1 hop vault at block 960,658.

    +
+HOP 1
+135d4c2c…2d4ce9
+−0.241352 BTC
+From Hop 1 from Aug 1 hop vault bc1qvrpc…cddc
+Block 960,658
+
+To 36c8aprK…QW35
  8. Relationship-enrollment bug in Bitkey capture noise +1 -0

    bitkey-relationship-enrollment-report · Block / vendor-response

    The trailing page-title line Relationship-enrollment bug in Bitkey | Bitkey toggled on again at the end of the extracted text; the report body was unchanged.

    +Relationship-enrollment bug in Bitkey | Bitkey
  9. COLDCARD entropy FAQ source content +8 -10

    coldcard-docs-faq · Coinkite / vendor-docs

    The entropy FAQ answer was rewritten, replacing the description of the TRNG/PRNG mix and SHA-256 whitening with revised wording that adds a note that hash conditioning is not a substitute for sufficient source entropy.

    -The TRNG from the MCU would be sufficient, but we also maintain a
-PRNG which is mixed (by XOR) into the TRNG output. That PRNG is
-seeded once at boot up from the TRNG in each of SE1 and SE2. We
-limit the of use the TRNG present in the secure elements because
-the protocol involved is complex and slow.
-The 256-bit number from the TRNG⊕PRNG is then "whitened" to remove
-bias, by running it through SHA256. This means if your attacker was
-somehow able to make the bits be 10% ones and 90% zeros (but still
-random otherwise) it would not help them, because after SHA256 the
-bit distribution will be 50/50 again.
+The MCU TRNG output is mixed (by XOR) with output from a PRNG. That
+PRNG is seeded once at boot from entropy obtained from SE1 and SE2.
+The secure-element entropy is used for seeding rather than for every
+request because the protocol is more complex and slower.
  10. Coinkite faces class action threat as bitcoin wallet bug costs users over 1,300 BTC capture noise +35 -35

    newsbitcom-class-action-threat · Bitcoin.com News / reporting

    Only rotating LATEST NEWS, MOST POPULAR and Related articles modules and their relative timestamps changed; the article text was unchanged.

    +MOST POPULAR
+A Man Bought a House for $1,000. Then He Found $10,000 in Envelopes Buried in the Basement
+1 day ago
+Bank of Montreal Filing Reports $2,970 XRP Position in $303B Portfolio
+1 day ago
+XRP Slides 69% From Peak While Existing Wallet Activity Climbs
+1 day ago
+Trump Takes ‘Major Step’ Toward Shutting Down Crypto Scammers
+1 day ago
+Whale Places $203M Short Bet Against Tokenized SpaceX Stock
+1 day ago
+LATEST NEWS
+JPMorgan Debanked Polymarket Over US Regulatory Concerns
+27 minutes ago
  11. What The Coldcard Flaw Reveals About Bitcoin Self Custody capture noise +6 -6

    ncfacanada-self-custody-commentary · NCFA Canada / reporting

    Only rotating sidebar article links and page-hit counters changed; the commentary text was unchanged.

    -Bill C-15 Gives Canada A Digital Finance Framework
-Who Gets Capital As Funding Channels Multiply?
-Casino Betscore Insights: What Makes an Online Casino User-Friendly
+Kevin Durant’s Bitcoin Recovery and User Protection
+Ledn Bitcoin Backed ABS Deal Enters Institutional Markets
+DMG Blockchain Plans Oregon Site for AI and Mining
-No. of Hits : 16480
+No. of Hits : 16522
-No. of Hits : 15730
+No. of Hits : 15766
-No. of Hits : 22852
+No. of Hits : 22868
  12. Galaxy loss estimate reporting blocked
  13. r/Bitcoin: no researcher has reproduced a seed for 153 source addresses containing 132.95 BTC source content +8 -0

    reddit-plot-thickens-coldcard-hack · reddit / community-discussion

    A reply by Ok-Courage-5115 was added comparing the unresolved seed-reconstruction gap to a leak where one interesting document is highlighted among many.

    +
+comment: p3tl6na
+parent: t1_p3phdsl
+author: Ok-Courage-5115
+created_utc: 1786792514
+edited: false
+body:
+It can well be classed as leak. It's like someone leaking 10 documents from some goverment office, saying: "You'll find one of them very interesting".
  14. r/Bitcoin: Rodolfo Novak deletes bitcoinsecurity.guide after claims of deceptive endorsement source content +8 -0

    reddit-novak-deletes-bitcoinsecurity-guide · reddit / community-discussion

    A reply by No-Contribution23 was added claiming that COLDCARD is not open source and that bitcoinsecurity.guide displayed a misleading green checkmark.

    +
+comment: p3stk69
+parent: t3_1vohwh6
+author: No-Contribution23
+created_utc: 1786778539
+edited: false
+body:
+coldcard is not open source and he still put a green check there. liar
  15. r/Bitcoin: claim that destroying hardware stock points to a possible second exploit source content +12 -0

    reddit-coldcards-next-exploit · reddit / community-discussion

    A reply by Oxymorix was added arguing that destroying affected inventory is more practical than reflashing because returning devices to factory-first-boot state may not be feasible.

    +
+comment: p3tjfec
+parent: t1_p3rdv4h
+author: Oxymorix
+created_utc: 1786791727
+edited: false
+body:
+Yes. It’s easier, faster, and cheaper to destroy a large number of devices with vulnerable firmware—in the case of COLDCARDs—than to open the old packaging, reflash each device, test it, and then repackage it.
+
+The issue is not just the firmware update itself. Each device would also have to go through the necessary testing and hardware checks. Beyond that, there is another complication: returning the device to the same factory-fresh state it was in when first powered on, where it displays the bag number and other initial setup information.
+
+Once Coinkite powers those devices on again for reflashing and testing, they may not be able to return them to that exact first-boot state, or at least not easily. For that reason, destroying the affected inventory may simply make more practical and economic sense.
  16. r/coldcard: complaint about Coinkite support silence and lack of public statement source content +10 -0

    reddit-coinkite-silence-unprofessional · reddit / community-discussion

    A reply by Mission-Disaster-447 was added, noting that Coinkite has created a security-status website and published blog posts and that individual support responses are not expected.

    +
+comment: p3sxv3m
+parent: t3_1vm708g
+author: Mission-Disaster-447
+created_utc: 1786780741
+edited: false
+body:
+They have created a whole website an published multiple blog posts on the matter. Its understandable that they cannot answer every query individually.
+
+[https://coldcard.com/security/status](https://coldcard.com/security/status)
  17. r/coldcard: first-hand report of wasted Coinkite steel plates after the forced migration source content +8 -0

    reddit-steel-plates-wasted · reddit / community-discussion

    The Reddit thread gained a reply from Oxymorix saying 'You should have rolled your own.'

    +
+comment: p3tm055
+parent: t1_p2yp3dd
+author: Oxymorix
+created_utc: 1786792876
+edited: false
+body:
+You should have rolled your own.
  18. r/coldcard: patent application from the bug's creator blocked
  19. How bitcoin cold wallets lost $70 million in an attack that never touched the devices capture noise +11 -12

    coindesk-70m-no-device-touch · CoinDesk / reporting

    Only the article's relative-time labels and the live cryptocurrency ticker values in the site navigation changed.

    -6 hrs ago
+12 hrs ago
-8 hrs ago
+15 hrs ago
-12 hrs ago
+18 hrs ago
-15 hrs ago
+22 hrs ago
-16 hrs ago
+22 hrs ago
-18 hrs ago
+1 day ago
-18 hrs ago
+1 day ago
  20. r/Bitcoin: reports of Coldcard devices bricked by the latest firmware entered the record

    reddit

  21. r/Bitcoin: reports of Coldcard devices bricked by the latest firmware baseline
  22. COLDCARD hack tracker source content +0 -8

    coldcard-hack-tracker · community tracker / chain-monitor

    The tracker removed the Holding 1 HOP 1 movement entry showing 0.241352 BTC sent from the Aug 1 hop vault in block 960,658.

    -
-HOP 1
-135d4c2c…2d4ce9
-−0.241352 BTC
-From Hop 1 from Aug 1 hop vault bc1qvrpc…cddc
-Block 960,658
-
-To 36c8aprK…QW35
  23. Full panic - one of my wallets was drained source content +2 -3

    reddit-full-panic-drain-report · r/Bitcoin / victim-account

    A comment by SharpGame83 was redacted: the author became [deleted] and the body became [removed].

    -author: SharpGame83
+author: [deleted]
-Honestly I get this now, when I first heard about bitcoin etfs I wondered who would prefer this over actual bitcoin? Old people?  
-Now after getting half a btc stolen from my blockchain wallet I’m like , ahhh ya I get it now
+[removed]
  24. Coinkite faces class action threat as bitcoin wallet bug costs users over 1,300 BTC capture noise +31 -31

    newsbitcom-class-action-threat · Bitcoin.com News / reporting

    Only rotating latest-news and most-popular rails and their relative-time labels changed; the article text was unchanged.

    -LATEST NEWS
-Strategy Pushes Back on MSCI Plan to Drop MSTR From Global Indexes
-46 minutes ago
-Bitwise Targets Solana Staking ETF for First Tokenized Shares
-2 hours ago
-Kalshi Pulls All Sports Mention Markets as CFTC Opens Review
-4 hours ago
-Bitcoin Slides to $62,470 as Sellers Test the $63K Floor Again
-5 hours ago
-SpaceX Closes $60 Billion Cursor Deal in Major AI Compute Push
-6 hours ago
-LATEST NEWS
-Strategy Pushes Back on MSCI Plan to Drop MSTR From Global Indexes
-46 minutes ago

Back to the evidence index, or read every detected difference as structured data in the JSON change feed.