COLDCARD RNG incident the public record, collected and explained
Informational only, and this site never asks for your seed words. details

Informational only. This is an open source collection of what others have published about the incident, together with an explanation of it. It is not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite. Material is attributed and quoted as published; where sources disagree their scenarios are kept separate with their assumptions rather than reconciled into one answer. Everything is meant to be checked against the linked evidence rather than taken on trust. Act on your own judgement about a particular situation. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it, and contributions containing recovery words or private keys are not accepted.

r/coldcard: speculation on Coinkite's next steps

reddit-coinkite-next-steps

https://www.reddit.com/r/coldcard/comments/1vd5f5h/coinkite_next_steps/

Latest reviewed change

source content difference between and

One short dismissive comment was removed from the thread.

seen +0 -8 full history below
 body:
 They should have paid for audits...tangem has...
 
-comment: p29o0un
-parent: t1_p18cagf
-author: Firm_Target101
-created_utc: 1786111459
-edited: false

First lines only. The complete diff is in the timeline below.

Organisation
reddit
Evidence role
Community discussion
Published
not established
Source changes
5
Detected differences
5
Unreviewed
0
Copies held
6

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .

  1. source content difference between and Current source content +0 -8

    One short dismissive comment was removed from the thread.

    seen · Captured here 14,233 chars
    What changed from the previous capture 8 lines
     body:
     They should have paid for audits...tangem has...
     
    -comment: p29o0un
    -parent: t1_p18cagf
    -author: Firm_Target101
    -created_utc: 1786111459
    -edited: false
    -body:
    -Lol smooooooooooth brain 
    -
     comment: p2fxw0d
     parent: t1_p1bls4t
     author: Skinny_Human
    
    Extracted text as captured
    post: 1vd5f5h
    author: RevolutionaryPick241
    created_utc: 1785636479
    title: Coinkite next steps
    body:
    Hey Coinkite, I know you are having big troubles right now. I have many of your products. Really enjoyed them, I like the cold part of them. I'm too paranoid to trust a RNG, so I expect not being affected by your really big mistake.
    
    My question is what will be your next steps, if you somehow survive as a company or even if you don't, I suggest open sourcing your firmware and your know-how. The reason for this is that it is fast peer reviewing and bug reporting that makes an open source project big. I contribute to many open source projects but never on closed ones (even if they are source code available).
    
    A Coldcard-DIY would be a great project.
    
    And open sourcing allows the community to maintain their devices and firmware in any case.
    
    But also, I don't think your current silence about what is going on is any helpful. People are bricking their devices because of lack of trust. Saying "sorry, install this firmware and you are ok" is an insult. That is my perspective. Focus on "don't trust, verify". No one trusts you now, but that is not needed if you become a more transparent and open company, or people if your company doesn't survive.
    
    comment: p16iduc
    parent: t3_1vd5f5h
    author: ironmoosen
    created_utc: 1785636841
    edited: false
    body:
    Yeah this is sad on multiple levels. Sad for the ones who got drained. Sad coinkite was so irresponsible. Sad because these were some of my favorite wallets. 
    
    comment: p16igq6
    parent: t3_1vd5f5h
    author: EricJDMBAMD
    created_utc: 1785636871
    edited: false
    body:
    If i were them i would just run all their code through kimi k3. Then fire anyone who allowed exploits into the code. Let AI rewrite the code then get it verfied checked by the community and AI before even thinking about selling a product
    
    comment: p16jf0e
    parent: t3_1vd5f5h
    author: s1ammage
    created_utc: 1785637230
    edited: false
    body:
    IMO, Coldcard (Coinkite) will be litigated into the ground
    
    comment: p16jigw

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  2. source content difference between and source content +8 -0

    The thread gained a new comment arguing the previous analogy was unnecessary and the point stood on its own.

    seen · Captured here 14,363 chars
    What changed from the previous capture 8 lines
     edited: false
     body:
     That’s like saying ‘the food in this restaurant is safe,provided you don’t eat there ’
    +
    +comment: p2hy62q
    +parent: t1_p2g41w5
    +author: EyesFor1
    +created_utc: 1786211108
    +edited: false
    +body:
    +Nah, its not.  There's not need for an analogy. It is as I described it, no need for a mythical deadly ham sandwich.
    
    Extracted text as captured
    post: 1vd5f5h
    author: RevolutionaryPick241
    created_utc: 1785636479
    title: Coinkite next steps
    body:
    Hey Coinkite, I know you are having big troubles right now. I have many of your products. Really enjoyed them, I like the cold part of them. I'm too paranoid to trust a RNG, so I expect not being affected by your really big mistake.
    
    My question is what will be your next steps, if you somehow survive as a company or even if you don't, I suggest open sourcing your firmware and your know-how. The reason for this is that it is fast peer reviewing and bug reporting that makes an open source project big. I contribute to many open source projects but never on closed ones (even if they are source code available).
    
    A Coldcard-DIY would be a great project.
    
    And open sourcing allows the community to maintain their devices and firmware in any case.
    
    But also, I don't think your current silence about what is going on is any helpful. People are bricking their devices because of lack of trust. Saying "sorry, install this firmware and you are ok" is an insult. That is my perspective. Focus on "don't trust, verify". No one trusts you now, but that is not needed if you become a more transparent and open company, or people if your company doesn't survive.
    
    comment: p16iduc
    parent: t3_1vd5f5h
    author: ironmoosen
    created_utc: 1785636841
    edited: false
    body:
    Yeah this is sad on multiple levels. Sad for the ones who got drained. Sad coinkite was so irresponsible. Sad because these were some of my favorite wallets. 
    
    comment: p16igq6
    parent: t3_1vd5f5h
    author: EricJDMBAMD
    created_utc: 1785636871
    edited: false
    body:
    If i were them i would just run all their code through kimi k3. Then fire anyone who allowed exploits into the code. Let AI rewrite the code then get it verfied checked by the community and AI before even thinking about selling a product
    
    comment: p16jf0e
    parent: t3_1vd5f5h
    author: s1ammage
    created_utc: 1785637230
    edited: false
    body:
    IMO, Coldcard (Coinkite) will be litigated into the ground
    
    comment: p16jigw

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  3. source content difference between and source content +20 -2

    An existing comment's author and body were deleted and replaced with [deleted] markers, and the thread gained two new comments, one calling the deleted comment the top comment and another comparing the safety claim to a restaurant where the food is safe only if you do not eat there.

    seen · Captured here 14,148 chars
    What changed from the previous capture 22 lines
     
     comment: p18cagf
     parent: t3_1vd5f5h
    -author: ToneCapwn
    +author: [deleted]
     created_utc: 1785667092
     edited: false
     body:
    -I will keep buying their product because of their open source and transparency. Ledger is not open source 
    +[deleted]
     
     comment: p18ir6m
     parent: t1_p188xlt
     edited: false
     body:
     Lol smooooooooooth brain 
    +
    +comment: p2fxw0d
    +parent: t1_p1bls4t
    +author: Skinny_Human
    +created_utc: 1786188349
    +edited: false
    +body:
    +This should be the top comment 
    +
    +All the CC fanboys in this thread, human psychology is fascinating 
    +
    +comment: p2g41w5
    +parent: t1_p1ajhbj
    +author: Skinny_Human
    +created_utc: 1786190879
    +edited: false
    +body:
    +That’s like saying ‘the food in this restaurant is safe,provided you don’t eat there ’
    
    Extracted text as captured
    post: 1vd5f5h
    author: RevolutionaryPick241
    created_utc: 1785636479
    title: Coinkite next steps
    body:
    Hey Coinkite, I know you are having big troubles right now. I have many of your products. Really enjoyed them, I like the cold part of them. I'm too paranoid to trust a RNG, so I expect not being affected by your really big mistake.
    
    My question is what will be your next steps, if you somehow survive as a company or even if you don't, I suggest open sourcing your firmware and your know-how. The reason for this is that it is fast peer reviewing and bug reporting that makes an open source project big. I contribute to many open source projects but never on closed ones (even if they are source code available).
    
    A Coldcard-DIY would be a great project.
    
    And open sourcing allows the community to maintain their devices and firmware in any case.
    
    But also, I don't think your current silence about what is going on is any helpful. People are bricking their devices because of lack of trust. Saying "sorry, install this firmware and you are ok" is an insult. That is my perspective. Focus on "don't trust, verify". No one trusts you now, but that is not needed if you become a more transparent and open company, or people if your company doesn't survive.
    
    comment: p16iduc
    parent: t3_1vd5f5h
    author: ironmoosen
    created_utc: 1785636841
    edited: false
    body:
    Yeah this is sad on multiple levels. Sad for the ones who got drained. Sad coinkite was so irresponsible. Sad because these were some of my favorite wallets. 
    
    comment: p16igq6
    parent: t3_1vd5f5h
    author: EricJDMBAMD
    created_utc: 1785636871
    edited: false
    body:
    If i were them i would just run all their code through kimi k3. Then fire anyone who allowed exploits into the code. Let AI rewrite the code then get it verfied checked by the community and AI before even thinking about selling a product
    
    comment: p16jf0e
    parent: t3_1vd5f5h
    author: s1ammage
    created_utc: 1785637230
    edited: false
    body:
    IMO, Coldcard (Coinkite) will be litigated into the ground
    
    comment: p16jigw

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  4. source content difference between and source content +8 -0

    The thread gained a short dismissive reply.

    seen · Captured here 13,853 chars
    What changed from the previous capture 8 lines
     edited: false
     body:
     They should have paid for audits...tangem has...
    +
    +comment: p29o0un
    +parent: t1_p18cagf
    +author: Firm_Target101
    +created_utc: 1786111459
    +edited: false
    +body:
    +Lol smooooooooooth brain 
    
    Extracted text as captured
    post: 1vd5f5h
    author: RevolutionaryPick241
    created_utc: 1785636479
    title: Coinkite next steps
    body:
    Hey Coinkite, I know you are having big troubles right now. I have many of your products. Really enjoyed them, I like the cold part of them. I'm too paranoid to trust a RNG, so I expect not being affected by your really big mistake.
    
    My question is what will be your next steps, if you somehow survive as a company or even if you don't, I suggest open sourcing your firmware and your know-how. The reason for this is that it is fast peer reviewing and bug reporting that makes an open source project big. I contribute to many open source projects but never on closed ones (even if they are source code available).
    
    A Coldcard-DIY would be a great project.
    
    And open sourcing allows the community to maintain their devices and firmware in any case.
    
    But also, I don't think your current silence about what is going on is any helpful. People are bricking their devices because of lack of trust. Saying "sorry, install this firmware and you are ok" is an insult. That is my perspective. Focus on "don't trust, verify". No one trusts you now, but that is not needed if you become a more transparent and open company, or people if your company doesn't survive.
    
    comment: p16iduc
    parent: t3_1vd5f5h
    author: ironmoosen
    created_utc: 1785636841
    edited: false
    body:
    Yeah this is sad on multiple levels. Sad for the ones who got drained. Sad coinkite was so irresponsible. Sad because these were some of my favorite wallets. 
    
    comment: p16igq6
    parent: t3_1vd5f5h
    author: EricJDMBAMD
    created_utc: 1785636871
    edited: false
    body:
    If i were them i would just run all their code through kimi k3. Then fire anyone who allowed exploits into the code. Let AI rewrite the code then get it verfied checked by the community and AI before even thinking about selling a product
    
    comment: p16jf0e
    parent: t3_1vd5f5h
    author: s1ammage
    created_utc: 1785637230
    edited: false
    body:
    IMO, Coldcard (Coinkite) will be litigated into the ground
    
    comment: p16jigw

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  5. source content difference between and source content +24 -0

    3 new Reddit comments were posted, all by Solid_Wolverine1639, discussing punishment, seedless wallets and audits.

    seen · Captured here 13,723 chars
    What changed from the previous capture 24 lines
     edited: false
     body:
     Minus the one dumbass who made this bug
    +
    +comment: p1nrvgt
    +parent: t1_p16iduc
    +author: Solid_Wolverine1639
    +created_utc: 1785854755
    +edited: false
    +body:
    +Happy for the criminals... Imagine it could just be one guy... Who's got to be a certain amount of theft that should warrant capital punishment...  This is more than enough of an example
    +
    +comment: p1ns5qi
    +parent: t1_p1akf4h
    +author: Solid_Wolverine1639
    +created_utc: 1785854830
    +edited: false
    +body:
    +What about seedless like tangem
    +
    +comment: p1nsfms
    +parent: t1_p1bls4t
    +author: Solid_Wolverine1639
    +created_utc: 1785854902
    +edited: false
    +body:
    +They should have paid for audits...tangem has...
    
    Extracted text as captured
    post: 1vd5f5h
    author: RevolutionaryPick241
    created_utc: 1785636479
    title: Coinkite next steps
    body:
    Hey Coinkite, I know you are having big troubles right now. I have many of your products. Really enjoyed them, I like the cold part of them. I'm too paranoid to trust a RNG, so I expect not being affected by your really big mistake.
    
    My question is what will be your next steps, if you somehow survive as a company or even if you don't, I suggest open sourcing your firmware and your know-how. The reason for this is that it is fast peer reviewing and bug reporting that makes an open source project big. I contribute to many open source projects but never on closed ones (even if they are source code available).
    
    A Coldcard-DIY would be a great project.
    
    And open sourcing allows the community to maintain their devices and firmware in any case.
    
    But also, I don't think your current silence about what is going on is any helpful. People are bricking their devices because of lack of trust. Saying "sorry, install this firmware and you are ok" is an insult. That is my perspective. Focus on "don't trust, verify". No one trusts you now, but that is not needed if you become a more transparent and open company, or people if your company doesn't survive.
    
    comment: p16iduc
    parent: t3_1vd5f5h
    author: ironmoosen
    created_utc: 1785636841
    edited: false
    body:
    Yeah this is sad on multiple levels. Sad for the ones who got drained. Sad coinkite was so irresponsible. Sad because these were some of my favorite wallets. 
    
    comment: p16igq6
    parent: t3_1vd5f5h
    author: EricJDMBAMD
    created_utc: 1785636871
    edited: false
    body:
    If i were them i would just run all their code through kimi k3. Then fire anyone who allowed exploits into the code. Let AI rewrite the code then get it verfied checked by the community and AI before even thinking about selling a product
    
    comment: p16jf0e
    parent: t3_1vd5f5h
    author: s1ammage
    created_utc: 1785637230
    edited: false
    body:
    IMO, Coldcard (Coinkite) will be litigated into the ground
    
    comment: p16jigw

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  6. Earliest copy held
    seen · Captured here 13,128 chars
    Extracted text as captured
    post: 1vd5f5h
    author: RevolutionaryPick241
    created_utc: 1785636479
    title: Coinkite next steps
    body:
    Hey Coinkite, I know you are having big troubles right now. I have many of your products. Really enjoyed them, I like the cold part of them. I'm too paranoid to trust a RNG, so I expect not being affected by your really big mistake.
    
    My question is what will be your next steps, if you somehow survive as a company or even if you don't, I suggest open sourcing your firmware and your know-how. The reason for this is that it is fast peer reviewing and bug reporting that makes an open source project big. I contribute to many open source projects but never on closed ones (even if they are source code available).
    
    A Coldcard-DIY would be a great project.
    
    And open sourcing allows the community to maintain their devices and firmware in any case.
    
    But also, I don't think your current silence about what is going on is any helpful. People are bricking their devices because of lack of trust. Saying "sorry, install this firmware and you are ok" is an insult. That is my perspective. Focus on "don't trust, verify". No one trusts you now, but that is not needed if you become a more transparent and open company, or people if your company doesn't survive.
    
    comment: p16iduc
    parent: t3_1vd5f5h
    author: ironmoosen
    created_utc: 1785636841
    edited: false
    body:
    Yeah this is sad on multiple levels. Sad for the ones who got drained. Sad coinkite was so irresponsible. Sad because these were some of my favorite wallets. 
    
    comment: p16igq6
    parent: t3_1vd5f5h
    author: EricJDMBAMD
    created_utc: 1785636871
    edited: false
    body:
    If i were them i would just run all their code through kimi k3. Then fire anyone who allowed exploits into the code. Let AI rewrite the code then get it verfied checked by the community and AI before even thinking about selling a product
    
    comment: p16jf0e
    parent: t3_1vd5f5h
    author: s1ammage
    created_utc: 1785637230
    edited: false
    body:
    IMO, Coldcard (Coinkite) will be litigated into the ground
    
    comment: p16jigw

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.