The Paranoid Wallet

citadel21-paranoid-wallet

https://www.citadel21.com/the-paranoid-wallet

Organisation

Citadel21

Evidence role

Secondary analysis

Published

2026-08-09

Source changes

0

Detected differences

0

Unreviewed

0

Copies held

1

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked 15 Aug 2026, 12:56 UTC.

1. Earliest copy held Current
   seen 9 Aug 2026, 02:05 UTC · Captured here 45,715 chars
   Extracted text as captured

   0
   Skip to Content
   Home
   Volumes
   Shop
   About
   Open Menu
   Close Menu
   Home
   Volumes
   Shop
   About
   Open Menu
   Close Menu
   Home
   Volumes
   Shop
   About
   The Paranoid Wallet
   For five years, the most trusted wallet in Bitcoin generated keys an attacker could guess
   by hodlonaut | Aug. 7th, 2026
   On the night of July 30, 2026, an attacker spent about forty minutes moving other people's Bitcoin. The coins came out of thousands of addresses, in waves. By August 4, the research firm Galaxy put the confirmed haul at 1,596 bitcoin taken from roughly 7,300 addresses across three waves and fourteen smaller incidents, and estimated that including suspected cases would push the total toward 2,000 bitcoin, on the order of 130 million dollars. Nobody was phished. No malware was involved. No device was touched. The attacker did not need any of that, because the wallets had told the world their secret years earlier, in the way they were born.
   The wallets were Coldcards. For most of the last decade the Coldcard, made by the Canadian company Coinkite, was the hardware wallet that serious Bitcoiners recommended to each other. It was the cypherpunk choice, the one that came with a dice-roll feature and a security-first reputation and a founder who told you, loudly, that everyone else was doing it wrong. It was the paranoid option, and paranoia was the point.
   What the sweep revealed is that for five years the paranoid option had been generating its seeds from a random number generator that was not random. The flaw was not exotic. It was a single character in a line of code, sitting in the open, in a public repository, waiting. This is the story of how it got there, who put it there, who tried to warn them, and why a community that built its entire identity around the phrase don't trust, verify spent five years trusting and not verifying.
   Part I: The Seed
   A Bitcoin wallet is a very large number. The private key that controls your coins is one specific value out of a space so enormous that guessing it is pure fantasy. A twelve-word recovery phrase encodes 128 bits of that space. To search it by brute force you would need more time than the universe has left.
   That protection rests entirely on one assumption. The number has to be genuinely unpredictable. It has to come from real randomness, what cryptographers call entropy. A hardware wallet has exactly one job that matters more than any other: draw a truly random number from a physical source, and never let anything weaker stand in for it. Everything else is decoration.
   The Coldcard has a hardware true random number generator on its chip, the physical source it is supposed to use. Coinkite has long marketed the device's careful approach to randomness, including an option to add your own entropy with dice rolls. On paper, the seed was safe.
   On affected firmware, the request for randomness was still made, but it no longer reached the hardware. According to the engineering team at Block, which published the first detailed technical analysis, and the security firm Wizardsardine, which traced the same path independently, the call that was supposed to draw on the hardware generator silently resolved to software instead, so that the routine meant to mix physical noise with a backup was in fact mixing two software generators together. One of them, inside the libngu library, began from constants written into the source, identical on every Coldcard in the world, and contributed, as Wizardsardine put it, zero entropy.
   The other seeded itself from the chip's unique identifier and the state of its internal clock, values that are neither secret nor genuinely random. What the seed rested on, in the end, was a small and guessable amount of state, and how small depended on which Coldcard you owned.
   Coinkite's own estimate, published in its “Technical Deep Dive into the Entropy Issue” blog post, is that effective entropy dropped to roughly 40 bits on the Mk2 and Mk3, and about 72 bits on the newer Mk4, Mk5 and Q, against the 128 the wallet was supposed to deliver.
   Forty bits is not a fantasy to search. An attacker who knew a wallet's public address could regenerate the small set of possible seeds, check each one against the blockchain, find the match, and take the coins, without ever seeing the device.
   The dice rolls saved the people who used them. A seed built with fifty or more private dice rolls mixed in real entropy the software could not poison, and Coinkite says those seeds are not at risk from this flaw.
   A strong, unique passphrase was also a safeguard against this exploit. Almost everyone else who generated a seed on the affected firmware was exposed, and most of them had no idea.
   The company built a whole guide around that promise. Coldcard's own documentation includes a Paranoid Guide, a tutorial for the most security-conscious setup, which instructs that the device shall never, in its entire life, be connected to a computer of any kind, taking power from a wall adapter and exchanging data only by moving an SD card back and forth. Paranoid was not a word critics reached for. It was the company's own name for the most careful way to own the device.
   The cruelest part is what the Coldcard was famous for. Its signature feature was that it never had to touch a computer. You could run it air-gapped, moving transactions on and off with an SD card, so that even if your PC was riddled with malware, nothing could reach across the gap to the keys. On the Stephan Livera Podcast in February 2021, NVK explained the logic at length: the point of air-gapping, he said, is that even if an attacker knows a vulnerability exists, he cannot get in remotely and retrieve what he is seeking. That was the whole security model, and against most threats it is sound. It did nothing here. The entropy flaw needed no reaching in and nothing to retrieve. The seed was already guessable from the public blockchain, so the attacker never had to touch the device, connected or not. The one feature that made the Coldcard feel safest was, against the failure that actually came, completely beside the point.
   Part II: One Commit
   The flaw entered the codebase on a single day, March 1, 2021, in a single commit. It is public. Anyone can read it. Its message is First pass w/ libNgU, its identifier begins b18723d, and it changed 120 files, adding 2,766 lines and removing 2,722. It was authored by the GitHub account doc-hex.
   That one commit did several things at once. It deleted the file named COPYING, which held the text of the GPL version 3 license. It removed a submodule pointing at a Trezor-derived cryptography library, the mature, years-hardened code Coldcard had been built on. It added a new submodule pointing at a library called libngu, owned by an account named switck.
   And in the same sweep it reworked the files that generate the wallet's seed, including the board configuration header and a new random-number file.

   Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.