COLDCARD RNG incident the public record, collected and explained
Informational only, and this site never asks for your seed words. details

Informational only. This is an open source collection of what others have published about the incident, together with an explanation of it. It is not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite. Material is attributed and quoted as published; where sources disagree their scenarios are kept separate with their assumptions rather than reconciled into one answer. Everything is meant to be checked against the linked evidence rather than taken on trust. Act on your own judgement about a particular situation. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it, and contributions containing recovery words or private keys are not accepted.

COLDCARD entropy FAQ

coldcard-docs-faq

https://coldcard.com/docs/faq/

Latest reviewed change

source content difference between and

The entropy FAQ answer was rewritten, replacing the description of the TRNG/PRNG mix and SHA-256 whitening with revised wording that adds a note that hash conditioning is not a substitute for sufficient source entropy.

seen +8 -10 full history below
 TRNG (True Random Number Generator), inside the main chip. This is
 a dedicated hardware subsystem that measures analog noise produced
 by a special transistor.
-The TRNG from the MCU would be sufficient, but we also maintain a
-PRNG which is mixed (by XOR) into the TRNG output. That PRNG is
-seeded once at boot up from the TRNG in each of SE1 and SE2. We
-limit the of use the TRNG present in the secure elements because
-the protocol involved is complex and slow.

First lines only. The complete diff is in the timeline below.

Organisation
Coinkite
Evidence role
Vendor documentation
Published
not established
Source changes
3
Detected differences
4
Unreviewed
0
Copies held
5

The pre-incident entropy description: hardware TRNG from transistor noise, a PRNG XOR'd into it, SE1/SE2 boot seeding, SHA-256 whitening, and the line that dice add "to the 256 bits of entropy already picked". Quoted on /how-it-broke/ to compare stated design against what shipped. It is monitored closely because it describes the affected subsystem. The first capture is post-disclosure and does not establish the page's earlier wording.

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .

  1. source content difference between and Current source content +8 -10

    The entropy FAQ answer was rewritten, replacing the description of the TRNG/PRNG mix and SHA-256 whitening with revised wording that adds a note that hash conditioning is not a substitute for sufficient source entropy.

    seen · Captured here 17,736 chars
    What changed from the previous capture 18 lines
     TRNG (True Random Number Generator), inside the main chip. This is
     a dedicated hardware subsystem that measures analog noise produced
     by a special transistor.
    -The TRNG from the MCU would be sufficient, but we also maintain a
    -PRNG which is mixed (by XOR) into the TRNG output. That PRNG is
    -seeded once at boot up from the TRNG in each of SE1 and SE2. We
    -limit the of use the TRNG present in the secure elements because
    -the protocol involved is complex and slow.
    -The 256-bit number from the TRNG⊕PRNG is then "whitened" to remove
    -bias, by running it through SHA256. This means if your attacker was
    -somehow able to make the bits be 10% ones and 90% zeros (but still
    -random otherwise) it would not help them, because after SHA256 the
    -bit distribution will be 50/50 again.
    +The MCU TRNG output is mixed (by XOR) with output from a PRNG. That
    +PRNG is seeded once at boot from entropy obtained from SE1 and SE2.
    +The secure-element entropy is used for seeding rather than for every
    +request because the protocol is more complex and slower.
    +The 256-bit mixed value is then conditioned with SHA-256 before it is
    +used by the seed-generation workflow. Hash conditioning is not a
    +substitute for sufficient source entropy; it produces a deterministic
    +output from the input it receives.
     During seed picking process, you have the option of "adding dice
     rolls" to increase the entropy and/or mitigate any possible manipulation.
     You can add as many rolls as you wish, and the entropy (about 2.5
    
    Extracted text as captured
    Skip to content
    COLDCARD Documentation
    COLDCARD FAQ
    Initializing search
    Documentation
    COLDCARD Home
    Buy Now!
    COLDCARD Documentation
    Documentation
    Documentation
    Guides
    Guides
    Getting Started
    Getting Started
    Quickstart! Start Here!
    Q Quickstart Guide
    Guide For Bitcoin Beginners
    PINs
    Master Seed
    Ready To Sign?
    Sending and Receiving Bitcoin for Beginners
    COLDCARD Ultra Quick Guide
    COLDCARD Middle Ground Guide
    COLDCARD Paranoid Guide
    General
    General
    Upgrade Firmware
    Settings Menu
    Address Explorer
    Verify Address Ownership
    QR Scanner
    Encrypted Backups
    NFC Tools
    Secure Notes & Passwords
    Multisig Features
    Airgap Multisig
    Seed Management
    Seed Management
    Generate Seed
    Generate Seed

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  2. source content difference between and source content +1 -1

    The FAQ changed one migration-guide link text from Check firmware and migration steps to Open the step-by-step migration guide.

    seen · Captured here 17,843 chars
    What changed from the previous capture 2 lines
     Where do I learn all technical details?
     COLDCARD Security Advisory
     A seed-generation defect affected releases beginning with firmware 4.0.1. Fixed firmware is available. Existing affected seeds still require migration.
    -Check firmware and migration steps
    +Open the step-by-step migration guide
     Home
     Docs
     COLDCARD FAQ
    
    Extracted text as captured
    Skip to content
    COLDCARD Documentation
    COLDCARD FAQ
    Initializing search
    Documentation
    COLDCARD Home
    Buy Now!
    COLDCARD Documentation
    Documentation
    Documentation
    Guides
    Guides
    Getting Started
    Getting Started
    Quickstart! Start Here!
    Q Quickstart Guide
    Guide For Bitcoin Beginners
    PINs
    Master Seed
    Ready To Sign?
    Sending and Receiving Bitcoin for Beginners
    COLDCARD Ultra Quick Guide
    COLDCARD Middle Ground Guide
    COLDCARD Paranoid Guide
    General
    General
    Upgrade Firmware
    Settings Menu
    Address Explorer
    Verify Address Ownership
    QR Scanner
    Encrypted Backups
    NFC Tools
    Secure Notes & Passwords
    Multisig Features
    Airgap Multisig
    Seed Management
    Seed Management
    Generate Seed
    Generate Seed

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  3. source content difference between and source content +3 -0

    The FAQ page added a security advisory banner stating a seed-generation defect affected firmware 4.0.1 onward, that fixed firmware is available, and that affected seeds still require migration.

    seen · Captured here 17,840 chars
    What changed from the previous capture 3 lines
     What happens when I can't remember my PIN?
     Where does the entropy (randomness) come from?
     Where do I learn all technical details?
    +COLDCARD Security Advisory
    +A seed-generation defect affected releases beginning with firmware 4.0.1. Fixed firmware is available. Existing affected seeds still require migration.
    +Check firmware and migration steps
     Home
     Docs
     COLDCARD FAQ
    
    Extracted text as captured
    Skip to content
    COLDCARD Documentation
    COLDCARD FAQ
    Initializing search
    Documentation
    COLDCARD Home
    Buy Now!
    COLDCARD Documentation
    Documentation
    Documentation
    Guides
    Guides
    Getting Started
    Getting Started
    Quickstart! Start Here!
    Q Quickstart Guide
    Guide For Bitcoin Beginners
    PINs
    Master Seed
    Ready To Sign?
    Sending and Receiving Bitcoin for Beginners
    COLDCARD Ultra Quick Guide
    COLDCARD Middle Ground Guide
    COLDCARD Paranoid Guide
    General
    General
    Upgrade Firmware
    Settings Menu
    Address Explorer
    Verify Address Ownership
    QR Scanner
    Encrypted Backups
    NFC Tools
    Secure Notes & Passwords
    Multisig Features
    Airgap Multisig
    Seed Management
    Seed Management
    Generate Seed
    Generate Seed

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  4. Earliest copy held
    seen · Captured here 17,624 chars
    Extracted text as captured
    Skip to content
    COLDCARD Documentation
    COLDCARD FAQ
    Initializing search
    Documentation
    COLDCARD Home
    Buy Now!
    COLDCARD Documentation
    Documentation
    Documentation
    Guides
    Guides
    Getting Started
    Getting Started
    Quickstart! Start Here!
    Q Quickstart Guide
    Guide For Bitcoin Beginners
    PINs
    Master Seed
    Ready To Sign?
    Sending and Receiving Bitcoin for Beginners
    COLDCARD Ultra Quick Guide
    COLDCARD Middle Ground Guide
    COLDCARD Paranoid Guide
    General
    General
    Upgrade Firmware
    Settings Menu
    Address Explorer
    Verify Address Ownership
    QR Scanner
    Encrypted Backups
    NFC Tools
    Secure Notes & Passwords
    Multisig Features
    Airgap Multisig
    Seed Management
    Seed Management
    Generate Seed
    Generate Seed

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

1 presentation-noise difference. Sidebar, ticker and other page chrome churn that our review classified as not being a change to what the source says.
  • +1 -1 Only the FAQ footer's Last update date changed from July 31 to August 1; no extracted FAQ answer changed.
How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.