COLDCARD firmware security audit dated 17 June 2026
nickfarrow-coldcard-audit-2026-06-17
https://gist.github.com/nickfarrow/4e97c71c8f1acd01aedce671621081d2
- Organisation
- Nick Farrow
- Evidence role
- Independent primary analysis
- Published
- 2026-08-02
- Source changes
- 0
- Detected differences
- 0
- Unreviewed
- 0
- Copies held
- 1
Read-only security audit published as a gist on 2 Aug 2026 and dated 17 June 2026, weeks before the incident became public. Weak RNG was in its stated scope and its bottom line clears the RNG, signing path and fee logic; the confirmed findings are a physical-access secure-element parser overflow and defense-in-depth gaps. Part of the record of what pre-incident review did and did not catch.
Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .
This post is held twice: here, with this project's own note on why it matters, and again as part of the conversation captured at , which is polled for changes. Both copies are the same post; neither is a separate event.
Snapshot and diff bodies for this chain monitor are held in the local evidence archive but withheld from the public site because they can contain the addresses of people who published nothing themselves. Capture times and reviewed change summaries remain available below.
Held captures
-
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 0 lines
Extracted text as captured
Skip to content Search Gists Search Gists All gists Back to GitHub Sign in Sign up Sign in Sign up You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert {{ message }} Instantly share code, notes, and snippets. nickfarrow/COLDCARD-AUDIT-2026-06-17.md Created August 2, 2026 07:08 Show Gist options Download ZIP Star 0 (0) You must be signed in to star a gist Fork 0 (0) You must be signed in to fork a gist Embed Select an option Embed Embed this gist in your website. Share Copy sharable link for this gist. Clone via HTTPS Clone using the web URL. No results found Learn more about clone URLs Clone this repository at <script src="https://gist.github.com/nickfarrow/4e97c71c8f1acd01aedce671621081d2.js"></script> Save nickfarrow/4e97c71c8f1acd01aedce671621081d2 to your computer and use it in GitHub Desktop.Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
0 presentation-noise differences. Sidebar, ticker and other page chrome churn that our review classified as not being changes to what the source says.
The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.
Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.
Compare the screenshot or a quotation against the original while it is available.