COLDCARD RNG incident the public record, collected and explained
Informational only, and this site never asks for your seed words. details

Informational only. This is an open source collection of what others have published about the incident, together with an explanation of it. It is not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite. Material is attributed and quoted as published; where sources disagree their scenarios are kept separate with their assumptions rather than reconciled into one answer. Everything is meant to be checked against the linked evidence rather than taken on trust. Act on your own judgement about a particular situation. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it, and contributions containing recovery words or private keys are not accepted.

r/coldcard: critique of the COLDCARD codebase and development practices

reddit-codebase-practices-critique

https://www.reddit.com/r/coldcard/comments/1vdrbxo/if_your_coldcard_isnt_in_the_trash_already_read/

Latest reviewed change

source content difference between and

1 new Reddit comment was posted, by MysteriousAlpaco, criticizing the codebase and testing practices.

seen +8 -0 full history below 
 edited: false
 body:
 Silver lining, this does is make the software/hardware stronger. 
+
+comment: p1nqtay
+parent: t1_p1fb04n
+author: MysteriousAlpaco
+created_utc: 1785854475

First lines only. The complete diff is in the timeline below.

Organisation
reddit
Evidence role
Community discussion
Published
not established
Source changes
1
Detected differences
1
Unreviewed
0
Copies held
2

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .

  1. source content difference between and Current source content +8 -0

    1 new Reddit comment was posted, by MysteriousAlpaco, criticizing the codebase and testing practices.

    seen · Captured here 13,587 chars
    What changed from the previous capture 8 lines 
     edited: false
 body:
 Silver lining, this does is make the software/hardware stronger. 
+
+comment: p1nqtay
+parent: t1_p1fb04n
+author: MysteriousAlpaco
+created_utc: 1785854475
+edited: false
+body:
+ the code, commit messages, no rigorous testing, the quality is honestly questionable. To each their own but I wouldnt wanna store anything valuable when thats the kind of "professionalism" put in that codebase.
    Extracted text as captured 
    post: 1vdrbxo
author: ardevd
created_utc: 1785699425
title: If your Coldcard isn't in the trash already, read this
body:
Under all the fluff of a cyberpunk hardware wallet was a shaky complex codebase backed by shoddy and lazy development practices.

comment: p1bh80c
parent: t3_1vdrbxo
author: froch_
created_utc: 1785701798
edited: false
body:
I think that might be the best validation that there is no other bug in the code. Hundreds of researchers and developers looked at it, scanned it with LLMs in the last 2 days.   
My 2 cents but I think it’s fine 

comment: p1bhcww
parent: t3_1vdrbxo
author: Silent_Ad_9963
created_utc: 1785701835
edited: false
body:
What I find interesting is that we are behaving like they , coinkite, kept all of this hidden and secret and the vulnerability brought these dark secrets to the surface.

Reality is that all of this , the vulnerability as well as the bad development practices were all under the sun ... Where was the scrutiny over the last 5 years ? 

Not trying to take blame away from them. They are 100% to blame in this ... But the community did not protect itself, which is why all this "let's all move to XYZ" cause they are doing it right is very scary ... Is a ticking bomb for the same to happen again.

What we need is community involvement into scrutiny of the code and the practices 

comment: p1bhof3
parent: t1_p1bhcww
author: ardevd
created_utc: 1785701924
edited: false
body:
I agree. Its astonishing the bug wasn't discovered ages ago and made public. It was staring us all in the face for years. 

comment: p1bmg0f
parent: t3_1vdrbxo

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  2. Earliest copy held
    seen · Captured here 13,268 chars
    Extracted text as captured 
    post: 1vdrbxo
author: ardevd
created_utc: 1785699425
title: If your Coldcard isn't in the trash already, read this
body:
Under all the fluff of a cyberpunk hardware wallet was a shaky complex codebase backed by shoddy and lazy development practices.

comment: p1bh80c
parent: t3_1vdrbxo
author: froch_
created_utc: 1785701798
edited: false
body:
I think that might be the best validation that there is no other bug in the code. Hundreds of researchers and developers looked at it, scanned it with LLMs in the last 2 days.   
My 2 cents but I think it’s fine 

comment: p1bhcww
parent: t3_1vdrbxo
author: Silent_Ad_9963
created_utc: 1785701835
edited: false
body:
What I find interesting is that we are behaving like they , coinkite, kept all of this hidden and secret and the vulnerability brought these dark secrets to the surface.

Reality is that all of this , the vulnerability as well as the bad development practices were all under the sun ... Where was the scrutiny over the last 5 years ? 

Not trying to take blame away from them. They are 100% to blame in this ... But the community did not protect itself, which is why all this "let's all move to XYZ" cause they are doing it right is very scary ... Is a ticking bomb for the same to happen again.

What we need is community involvement into scrutiny of the code and the practices 

comment: p1bhof3
parent: t1_p1bhcww
author: ardevd
created_utc: 1785701924
edited: false
body:
I agree. Its astonishing the bug wasn't discovered ages ago and made public. It was staring us all in the face for years. 

comment: p1bmg0f
parent: t3_1vdrbxo

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.