COLDCARD RNG incident the public record, collected and explained
Informational only, and this site never asks for your seed words. details

Informational only. This is an open source collection of what others have published about the incident, together with an explanation of it. It is not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite. Material is attributed and quoted as published; where sources disagree their scenarios are kept separate with their assumptions rather than reconciled into one answer. Everything is meant to be checked against the linked evidence rather than taken on trust. Act on your own judgement about a particular situation. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it, and contributions containing recovery words or private keys are not accepted.

One Commit, Two Random Sources: how COLDCARD's seed generation was moved off the hardware RNG

afilini-seed-rng-migration-report

https://gist.github.com/afilini/b7d13bd2d7deaf8f23d30213a801e3c5

Organisation
afilini
Evidence role
Independent primary analysis
Published
2026-08-05
Source changes
0
Detected differences
1
Unreviewed
0
Copies held
2

Commit-level reading of b18723dd (1 March 2021), the libngu integration, which the report says moved only seed.py and random.py from the ckcc.rng hardware API to ngu.random while backups and file erasure stayed on the hardware path. Its conclusion is that this was a selective rather than blanket migration that then stood for five years. Primary work rather than reporting on it: the report states the git commands and line-by-line diffs it rests on, so a reader can re-run them. The report discloses AI assistance in its own text. The selective migration reading and its inferences are the author's, not verified here, and the report does not assert intent. Its subject matter overlaps dylanleclair1-switck-key-attribution and reddit-switck-identity-claims, which preserve a separate identity claim about the same code. The gist had four revisions within two hours of creation, so it is watched rather than treated as a one-shot capture.

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .

  1. Earliest copy held
    seen · Captured here 13,347 chars
    Extracted text as captured
    Skip to content
    Search Gists
    Search Gists
    All gists
    Back to GitHub
    Sign in
    Sign up
    Sign in
    Sign up
    You signed in with another tab or window. Reload to refresh your session.
    You signed out in another tab or window. Reload to refresh your session.
    You switched accounts on another tab or window. Reload to refresh your session.
    Dismiss alert
    {{ message }}
    Instantly share code, notes, and snippets.
    afilini/report.md
    Secret
    Last active
    August 5, 2026 15:11
    Show Gist options
    Download ZIP
    Star
    0
    (0)
    You must be signed in to star a gist
    Fork
    0
    (0)
    You must be signed in to fork a gist
    Embed
    Select an option
    Embed
    Embed this gist in your website.
    Share
    Copy sharable link for this gist.
    Clone via HTTPS
    Clone using the web URL.
    No results found
    Learn more about clone URLs
    Clone this repository at <script src="https://gist.github.com/afilini/b7d13bd2d7deaf8f23d30213a801e3c5.js"></script>

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

1 presentation-noise difference. Sidebar, ticker and other page chrome churn that our review classified as not being a change to what the source says.
  • +5 -3 Only the gist's relative update label and star counter changed; no body text was added or removed.
How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.