COLDCARD RNG incident the public record, collected and explained
Informational only, and this site never asks for your seed words. details

Informational only. This is an open source collection of what others have published about the incident, together with an explanation of it. It is not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite. Material is attributed and quoted as published; where sources disagree their scenarios are kept separate with their assumptions rather than reconciled into one answer. Everything is meant to be checked against the linked evidence rather than taken on trust. Act on your own judgement about a particular situation. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it, and contributions containing recovery words or private keys are not accepted.

What The Coldcard Flaw Reveals About Bitcoin Self Custody

ncfacanada-self-custody-commentary

https://ncfacanada.org/coldcard-firmware-flaw-bitcoin-self-custody/

Organisation
NCFA Canada
Evidence role
Reporting
Published
2026-08-03
Source changes
0
Detected differences
27
Unreviewed
0
Copies held
28

Commentary from the National Crowdfunding and Fintech Association of Canada, the first Canadian industry-body view held here. Registered for the Canadian vantage rather than for new evidence: Coinkite is Toronto based, and the incident's legal dimension runs through Ontario statutes and a proposed Canadian suit.

Secondary throughout. Its loss figures (more than 1,000 BTC from 1,196 wallets in 41 minutes, two suspected later waves, an estimated total near US$89 million) are attributed to Galaxy Research, which is separately held here, and the piece carries its own caveat that not every wallet in those totals is confirmed to have been created with the affected firmware. Its argument, that self custody removes the custodian but not the vendor layer beneath it, is the author's position and is not adopted by this archive.

It also carries a compiled company profile naming Rodolfo Novak and Peter D. Gray as Coinkite's founders. That is public company record and is held as such. It must not be read as bearing on the separate and unverified claim about who wrote the pseudonymous libngu commits.

Browser capture with scrolling: the site answers plain scripted fetches with a challenge page, and the article body does not hydrate until the page is scrolled. Its robots.txt disallows only /wp-admin/, so this path is permitted.

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .

  1. Earliest copy held
    seen · Captured here 18,251 chars
    Extracted text as captured 
    

LEARN
»
REGULATION
»
EVENTS
»
MARKETPLACE
»
JOIN TODAY
»
ABOUT US
»
ADVOCACY
PODCAST
DIRECTORY
INNOVATION MAP
FINTECH WHISPERER
NEWS
RESEARCH
SUBSCRIBE
August 3, 2026   FinTech and Alternative Finance   No comments
What The Coldcard Flaw Reveals About Bitcoin Self Custody
Share

August 3, 2026 | NCFA Insight | Cybersecurity And Fraud, Digital Assets Blockchain And Tokenization, Risk Compliance And Regtech

Coldcard Firmware Flaw And Bitcoin Self Custody

On July 30, 2026, security researchers linked a rapid series of Bitcoin transfers to a reported Coldcard firmware flaw. Coldcard is a Bitcoin hardware wallet made by Toronto based Coinkite. Current reporting citing Galaxy Research estimates that more than 1,000 bitcoin left 1,196 wallets in 41 minutes, followed by two suspected waves that brought the estimated loss close to US$89 million. Researchers haven't confirmed that every wallet in those totals was created with the affected software.The Bitcoin network was not hacked. The reported failure occurred when certain Coldcard software generated wallet recovery phrases with too little randomness. If an attacker can narrow the possible phrases far enough, the private keys protecting the bitcoin may be calculated without stealing or touching the device.

It exposes a dependency that is easy to miss in self custody. Removing an exchange or custodian leaves the owner in control, but the owner still relies on the device, its firmware, the code that creates the recovery phrase and the process used to install updates.

The Failure Began When The Wallet Created Its Seed

A hardware wallet protects the private keys used to authorize Bitcoin transactions. The published Coldcard security model combines firmware controls with secure elements and offline signing. When a new wallet is created, the device generates a recovery phrase, often called a seed. That phrase can recreate the wallet and control its funds, so it needs enough randomness to keep attackers from guessing it.

The reported Coldcard flaw weakened that first step. A recovery phrase can look random to its owner while still coming from a much smaller set of possibilities than intended. An attacker doesn't need to defeat the device's secure elements or intercept a transaction if the phrase created at setup can be predicted.

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

27 presentation-noise differences. Sidebar, ticker and other page chrome churn that our review classified as not being changes to what the source says.
  • +6 -6 Only rotating sidebar article links and page-hit counters changed; the commentary text was unchanged.
  • +6 -6 Only rotating sidebar story links and page hit counters changed; the commentary text was unchanged.
  • +26 -26 Only rotating sidebar article links, category hit counters and page-hit counters changed; the commentary text was unchanged.
  • +17 -17 Only sidebar category counters, page-hit counters, and rotating related/recent post rails changed; the article body was unchanged.
  • +21 -21 Only site chrome changed: sidebar article links and category hit counters rotated, with no change to the commentary text.
  • +17 -17 Only site chrome changed: sidebar article links and category hit counters rotated, with no change to the commentary text.
  • +30 -30 Only rotating related-content headlines and live category hit counters changed; the article body was unchanged.
  • +6 -6 Only rotating sidebar article links and three page-hit counters changed; the commentary text was unchanged.
  • +6 -6 Only rotating related-post cards and article hit counters changed; the commentary text was unchanged.
  • +21 -21 Only category post counts, page-hit counters and rotating related-post rails changed; the commentary text was unchanged.
  • +6 -6 Only rotating sidebar article links and live page-hit counters changed; the commentary text was unchanged.
  • +35 -35 Only rotating sidebar story cards, category counts and page-hit counters changed; the article text was unchanged.
  • +5 -5 Only rotating recommendation cards and No. of Hits counters in the sidebar changed; the commentary body was unchanged.
  • +6 -6 Only the rotating related-content cards below the article and the page hit counters changed; the article text was unchanged.
  • +6 -6 Only rotating related-story cards and page hit counters changed; the Coldcard commentary text was unchanged.
  • +6 -6 Only rotating sidebar headline lists and page-view hit counters changed.
  • +6 -6 Only rotating Related Posts cards, Recent Posts items and page hit counters changed; the Coldcard commentary text was unchanged.
  • +6 -6 Only rotating related-article cards and page hit counters changed; the article text was unchanged.
  • +6 -6 Only the site's related-posts rail and three unrelated article hit counters changed. The commentary body, including the secondhand Galaxy Research figures, is unchanged.
  • +30 -30 Only sidebar related-content cards, category counters and hit counters changed; the article text was unchanged.
  • +27 -27 Site chrome only: the Related Posts and Recent Posts cards rotated to newer articles, and category post counts plus page hit counters ticked up. The self-custody commentary article itself is unchanged.
  • +6 -6 Rotating Related Posts cards and live hit counters changed again; the article body is unchanged.
  • +6 -6 Rotating Related Posts cards and live hit counters changed; the article body is unchanged.
  • +6 -6 Only unrelated linked-story cards and live hit counters changed; the commentary article text was unchanged.
  • +23 -23 Rotating related-post cards, category counts and page hit counters changed. The Coldcard commentary itself did not change.
  • +5 -5 Only rotating related-article cards and hit counters changed. The Coldcard commentary itself did not change.
  • +5 -5 Only rotating sidebar links and live hit counters changed. The article text did not change.
How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.