COLDCARD RNG incident the public record, collected and explained
Informational only, and this site never asks for your seed words. details

Informational only. This is an open source collection of what others have published about the incident, together with an explanation of it. It is not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite. Material is attributed and quoted as published; where sources disagree their scenarios are kept separate with their assumptions rather than reconciled into one answer. Everything is meant to be checked against the linked evidence rather than taken on trust. Act on your own judgement about a particular situation. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it, and contributions containing recovery words or private keys are not accepted.

Jade is unaffected

jade-not-affected

https://blog.blockstream.com/jade-unaffected-coldcard-vulnerability/

Latest reviewed change

source content difference between and

Blockstream rewrote Step 4 of its migration guidance: the heading changed from "Retire the Old Recovery Phrase Safely" to "Hold Onto Your Old Device and Recovery Phrase", and the instructions to verify the old wallet is empty and then destroy the old backup were removed. The post now tells readers to keep the old phrase in case funds become recoverable later.

seen +0 -7 full history below
 Step 3: Send a Test Transaction, Then the Rest
 Send a small amount to the new address first. Wait for it to confirm, then check that the balance actually appears in the new wallet and that you can see it from a fresh session, not just the screen you were already looking at.
 Once the test lands and you've confirmed you can see it, proceed calmly, and move the full balance.
-Step 4: Retire the Old Recovery Phrase Safely
 Step 4: Hold Onto Your Old Device and Recovery Phrase
 Do not reuse your old recovery phrase.
 However, keep it handy. In the event that your funds become recoverable in the future, it may be necessary to prove ownership.
-Keep the old backup until the migration is completely confirmed. Destroying it early, while any balance remains, makes that balance unrecoverable.

First lines only. The complete diff is in the timeline below.

Organisation
Blockstream
Evidence role
Vendor statement
Published
2026-07-31
Source changes
1
Detected differences
1
Unreviewed
0
Copies held
2

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .

  1. source content difference between and Current source content +0 -7

    Blockstream rewrote Step 4 of its migration guidance: the heading changed from "Retire the Old Recovery Phrase Safely" to "Hold Onto Your Old Device and Recovery Phrase", and the instructions to verify the old wallet is empty and then destroy the old backup were removed. The post now tells readers to keep the old phrase in case funds become recoverable later.

    seen · Captured here 7,338 chars
    What changed from the previous capture 7 lines
     Step 3: Send a Test Transaction, Then the Rest
     Send a small amount to the new address first. Wait for it to confirm, then check that the balance actually appears in the new wallet and that you can see it from a fresh session, not just the screen you were already looking at.
     Once the test lands and you've confirmed you can see it, proceed calmly, and move the full balance.
    -Step 4: Retire the Old Recovery Phrase Safely
     Step 4: Hold Onto Your Old Device and Recovery Phrase
     Do not reuse your old recovery phrase.
     However, keep it handy. In the event that your funds become recoverable in the future, it may be necessary to prove ownership.
    -Keep the old backup until the migration is completely confirmed. Destroying it early, while any balance remains, makes that balance unrecoverable.
    -Look for small leftover amounts, unconfirmed transactions, and any additional accounts or asset types you may have used on that device.
    -Once the old wallet is confirmed empty and the new one is verified working:
    -Destroy the old backup. Shred or burn paper; for a metal backup, physically destroy or restamp it.
    -Treat that phrase as permanently retired. Never import it into another wallet, never reuse it as a passphrase, and never enter it into a website, form, or phishing tool offering to check whether it's affected.
    -If you can't destroy the backup immediately, store it somewhere separate from your new backup so you never confuse the two.
     How Jade Builds Its Randomness
     Your recovery phrase is only as strong as the randomness behind it, so Jade never relies on a single source. Every Jade hashes together:
     Timing from user interaction
    
    Extracted text as captured
    Products
    CONSUMERS
    Blockstream App
    A multi-platform, feature-rich Bitcoin and Liquid Wallet
    Blockstream Jade
    A fully-open source hardware wallet for Bitcoin and Liquid
    ENTERPRISE
    Blockstream Enterprise
    Enterprise-grade custody and treasury management tool
    AMP
    An API to issue and manage digital assets on the Liquid Network
    DEVELOPERS
    TOOLS
    Blockstream Explorer API
    Search data from the Bitcoin and Liquid blockchains
    Greenlight
    Lightning node management for payments
    Cryptocurrency Data Feed
    Real-time and historical cryptocurrency trade data
    COMMUNITY PROJECTS
    Core Lightning
    Implementation of the Lightning Protocol
    Liquid Network
    Bitcoin layer-2 for digital asset issuance
    Elements
    An open-source, sidechain-capable blockchain platform
    Simplicity
    High-assurance smart contracts
    Newsroom
    Blog
    In
    The News
    Press
    Releases
    Quantum
    Developers
    Engineering
    Blog
    Liquid Documentation
    Core Lightning Documentation

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  2. Earliest copy held
    seen · Captured here 8,176 chars
    Extracted text as captured
    Products
    CONSUMERS
    Blockstream App
    A multi-platform, feature-rich Bitcoin and Liquid Wallet
    Blockstream Jade
    A fully-open source hardware wallet for Bitcoin and Liquid
    ENTERPRISE
    Blockstream Enterprise
    Enterprise-grade custody and treasury management tool
    AMP
    An API to issue and manage digital assets on the Liquid Network
    DEVELOPERS
    TOOLS
    Blockstream Explorer API
    Search data from the Bitcoin and Liquid blockchains
    Greenlight
    Lightning node management for payments
    Cryptocurrency Data Feed
    Real-time and historical cryptocurrency trade data
    COMMUNITY PROJECTS
    Core Lightning
    Implementation of the Lightning Protocol
    Liquid Network
    Bitcoin layer-2 for digital asset issuance
    Elements
    An open-source, sidechain-capable blockchain platform
    Simplicity
    High-assurance smart contracts
    Newsroom
    Blog
    In
    The News
    Press
    Releases
    Quantum
    Developers
    Engineering
    Blog
    Liquid Documentation
    Core Lightning Documentation

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.