COLDCARD RNG incident the public record, collected and explained
Informational only, and this site never asks for your seed words. details

Informational only. This is an open source collection of what others have published about the incident, together with an explanation of it. It is not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite. Material is attributed and quoted as published; where sources disagree their scenarios are kept separate with their assumptions rather than reconciled into one answer. Everything is meant to be checked against the linked evidence rather than taken on trust. Act on your own judgement about a particular situation. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it, and contributions containing recovery words or private keys are not accepted.

r/coldcard: Coinkite solvency and class-action speculation

reddit-coinkite-solvency-class-action

https://www.reddit.com/r/coldcard/comments/1vcs0o4/anyone_who_thinks_coinkite_will_remain_solvent/

Latest reviewed change

source content difference between and

The thread gained two new comments: one asking whether the poster inspected the open-source COLDCARD code or is just repeating what others say, and a reply explaining that the commenter uses their own air-gapped Python scripts instead of hardware wallets.

seen +22 -0 full history below
 body:
 Amazing that a single line of code caused all this.
 
+comment: p2fkl6u
+parent: t1_p1mqbpw
+author: sasankhatibi
+created_utc: 1786181955
+edited: false

First lines only. The complete diff is in the timeline below.

Organisation
reddit
Evidence role
Community discussion
Published
not established
Source changes
5
Detected differences
5
Unreviewed
0
Copies held
6

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .

  1. source content difference between and Current source content +22 -0

    The thread gained two new comments: one asking whether the poster inspected the open-source COLDCARD code or is just repeating what others say, and a reply explaining that the commenter uses their own air-gapped Python scripts instead of hardware wallets.

    seen · Captured here 19,184 chars
    What changed from the previous capture 22 lines
     body:
     Amazing that a single line of code caused all this.
     
    +comment: p2fkl6u
    +parent: t1_p1mqbpw
    +author: sasankhatibi
    +created_utc: 1786181955
    +edited: false
    +body:
    +ColdCard was/is open source. What's your excuse? Did YOU inspect it, or are you just repeating what others are telling you?
    +
    +comment: p2flj1q
    +parent: t1_p2fkl6u
    +author: magma_lakes
    +created_utc: 1786182441
    +edited: false
    +body:
    +I've been a programmer for many years, and I don't use any hardware wallets.
    +
    +I have a bunch of Python scripts that I wrote myself many years ago that generate a Bitcoin wallet, from scratch.
    +
    +I've copied them over to my air-gapped Linux PC, in order to generate my Bitcoin wallets.
    +
    +So, I don't need to inspect any hardware wallet's code, because I don't use them. I only need to inspect and trust my own code, which I do.
    +
     more-stub: parent t1_p1igcfs count <live-count>
    
    Extracted text as captured
    post: 1vcs0o4
    author: Provia100F
    created_utc: 1785602229
    title: Anyone who thinks Coinkite will remain solvent after the impending class action lawsuit is lying to themselves
    body:
    The devices themselves are probably fine after the firmware update, and apparently dice users are unaffected.
    
    That doesn't change the fact that millions of dollars have been lost by users, and it's quite literally guaranteed that lawyers are foaming at the mouth to be the first to file a class action lawsuit.
    
    Coinkite is a small company, there is quite literally no way under the sun that they will have sufficient funds to support a defense against a class action lawsuit of this magnitude, the outcome of said class action lawsuit is irrelevant because the legal fees for defense alone will bankrupt them.
    
    I think from a hardware perspective, the coldcard is a solid device, but this **is** the end of the company and you will need to come to terms with the understanding that we are all going to be transitioning to "orphan device" status before the end of the year.
    
    This is not an attack on Coinkite or Coldcard, this is just a plain statement of fact.
    
    comment: p13m373
    parent: t3_1vcs0o4
    author: ExplorerBoring9848
    created_utc: 1785603718
    edited: false
    body:
    That's why I'm interested in how best to repurpose the device. 
    
    comment: p13nb6w
    parent: t3_1vcs0o4
    author: YWorkFT
    created_utc: 1785604070
    edited: false
    body:
    Likely score some discount coldcards.
    
    comment: p13o8hc
    parent: t1_p13m373
    author: FaddyDuck5
    created_utc: 1785604334
    edited: false
    body:
    Don't use its RNG. These devices just hold the 12 or 24 silly words we write on paper. 
    
    comment: p13pff6

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  2. source content difference between and source content +8 -0

    New comment by Outrageous-Lab-2138: "Amazing that a single line of code caused all this."

    seen · Captured here 18,433 chars
    What changed from the previous capture 8 lines
     body:
     Hubris isn't anything new from the C-Suite.
     
    +comment: p2069jq
    +parent: t3_1vcs0o4
    +author: Outrageous-Lab-2138
    +created_utc: 1785994566
    +edited: false
    +body:
    +Amazing that a single line of code caused all this.
    +
     more-stub: parent t1_p1igcfs count <live-count>
    
    Extracted text as captured
    post: 1vcs0o4
    author: Provia100F
    created_utc: 1785602229
    title: Anyone who thinks Coinkite will remain solvent after the impending class action lawsuit is lying to themselves
    body:
    The devices themselves are probably fine after the firmware update, and apparently dice users are unaffected.
    
    That doesn't change the fact that millions of dollars have been lost by users, and it's quite literally guaranteed that lawyers are foaming at the mouth to be the first to file a class action lawsuit.
    
    Coinkite is a small company, there is quite literally no way under the sun that they will have sufficient funds to support a defense against a class action lawsuit of this magnitude, the outcome of said class action lawsuit is irrelevant because the legal fees for defense alone will bankrupt them.
    
    I think from a hardware perspective, the coldcard is a solid device, but this **is** the end of the company and you will need to come to terms with the understanding that we are all going to be transitioning to "orphan device" status before the end of the year.
    
    This is not an attack on Coinkite or Coldcard, this is just a plain statement of fact.
    
    comment: p13m373
    parent: t3_1vcs0o4
    author: ExplorerBoring9848
    created_utc: 1785603718
    edited: false
    body:
    That's why I'm interested in how best to repurpose the device. 
    
    comment: p13nb6w
    parent: t3_1vcs0o4
    author: YWorkFT
    created_utc: 1785604070
    edited: false
    body:
    Likely score some discount coldcards.
    
    comment: p13o8hc
    parent: t1_p13m373
    author: FaddyDuck5
    created_utc: 1785604334
    edited: false
    body:
    Don't use its RNG. These devices just hold the 12 or 24 silly words we write on paper. 
    
    comment: p13pff6

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  3. source content difference between and source content +8 -0

    Reddit added a comment characterising the discussion as another example of C-suite hubris.

    seen · Captured here 18,272 chars
    What changed from the previous capture 8 lines
     body:
     It was done on purpose, he probably is a good dev
     
    +comment: p1v8gam
    +parent: t1_p1ssbk5
    +author: FauxReal
    +created_utc: 1785941732
    +edited: false
    +body:
    +Hubris isn't anything new from the C-Suite.
    +
     more-stub: parent t1_p1igcfs count <live-count>
    
    Extracted text as captured
    post: 1vcs0o4
    author: Provia100F
    created_utc: 1785602229
    title: Anyone who thinks Coinkite will remain solvent after the impending class action lawsuit is lying to themselves
    body:
    The devices themselves are probably fine after the firmware update, and apparently dice users are unaffected.
    
    That doesn't change the fact that millions of dollars have been lost by users, and it's quite literally guaranteed that lawyers are foaming at the mouth to be the first to file a class action lawsuit.
    
    Coinkite is a small company, there is quite literally no way under the sun that they will have sufficient funds to support a defense against a class action lawsuit of this magnitude, the outcome of said class action lawsuit is irrelevant because the legal fees for defense alone will bankrupt them.
    
    I think from a hardware perspective, the coldcard is a solid device, but this **is** the end of the company and you will need to come to terms with the understanding that we are all going to be transitioning to "orphan device" status before the end of the year.
    
    This is not an attack on Coinkite or Coldcard, this is just a plain statement of fact.
    
    comment: p13m373
    parent: t3_1vcs0o4
    author: ExplorerBoring9848
    created_utc: 1785603718
    edited: false
    body:
    That's why I'm interested in how best to repurpose the device. 
    
    comment: p13nb6w
    parent: t3_1vcs0o4
    author: YWorkFT
    created_utc: 1785604070
    edited: false
    body:
    Likely score some discount coldcards.
    
    comment: p13o8hc
    parent: t1_p13m373
    author: FaddyDuck5
    created_utc: 1785604334
    edited: false
    body:
    Don't use its RNG. These devices just hold the 12 or 24 silly words we write on paper. 
    
    comment: p13pff6

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  4. source content difference between and source content +8 -0

    The thread gained a reply speculating that the incident was deliberate.

    seen · Captured here 18,130 chars
    What changed from the previous capture 8 lines
     
     You don't know if there's a bug if you can't inspect the code.
     
    +comment: p1ssbk5
    +parent: t1_p1c11un
    +author: Only_Assistant9176
    +created_utc: 1785907979
    +edited: false
    +body:
    +It was done on purpose, he probably is a good dev
    +
     more-stub: parent t1_p1igcfs count <live-count>
    
    Extracted text as captured
    post: 1vcs0o4
    author: Provia100F
    created_utc: 1785602229
    title: Anyone who thinks Coinkite will remain solvent after the impending class action lawsuit is lying to themselves
    body:
    The devices themselves are probably fine after the firmware update, and apparently dice users are unaffected.
    
    That doesn't change the fact that millions of dollars have been lost by users, and it's quite literally guaranteed that lawyers are foaming at the mouth to be the first to file a class action lawsuit.
    
    Coinkite is a small company, there is quite literally no way under the sun that they will have sufficient funds to support a defense against a class action lawsuit of this magnitude, the outcome of said class action lawsuit is irrelevant because the legal fees for defense alone will bankrupt them.
    
    I think from a hardware perspective, the coldcard is a solid device, but this **is** the end of the company and you will need to come to terms with the understanding that we are all going to be transitioning to "orphan device" status before the end of the year.
    
    This is not an attack on Coinkite or Coldcard, this is just a plain statement of fact.
    
    comment: p13m373
    parent: t3_1vcs0o4
    author: ExplorerBoring9848
    created_utc: 1785603718
    edited: false
    body:
    That's why I'm interested in how best to repurpose the device. 
    
    comment: p13nb6w
    parent: t3_1vcs0o4
    author: YWorkFT
    created_utc: 1785604070
    edited: false
    body:
    Likely score some discount coldcards.
    
    comment: p13o8hc
    parent: t1_p13m373
    author: FaddyDuck5
    created_utc: 1785604334
    edited: false
    body:
    Don't use its RNG. These devices just hold the 12 or 24 silly words we write on paper. 
    
    comment: p13pff6

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  5. source content difference between and source content +10 -0

    1 new Reddit comment was posted, including magma_lakes.

    seen · Captured here 17,972 chars
    What changed from the previous capture 10 lines
     body:
     I just want to understand why everybody says that, Ledger is a peace of shit, because not open source. On the other side, they produced over 7 million wallets, and no one is compromised so far. I was work for a multi-million dollar financial company for years. I work with Thales HSM cards. Never heard from any security expert that: "it is not safe, because closed source". I don't think who say it in youtube/reddit/X knows mutch more about the IT security than the experts I know.
     
    +comment: p1mqbpw
    +parent: t1_p17fzvj
    +author: magma_lakes
    +created_utc: 1785843516
    +edited: false
    +body:
    +... said ColdCard users about a week ago.
    +
    +You don't know if there's a bug if you can't inspect the code.
    +
     more-stub: parent t1_p1igcfs count 0
    
    Extracted text as captured
    post: 1vcs0o4
    author: Provia100F
    created_utc: 1785602229
    title: Anyone who thinks Coinkite will remain solvent after the impending class action lawsuit is lying to themselves
    body:
    The devices themselves are probably fine after the firmware update, and apparently dice users are unaffected.
    
    That doesn't change the fact that millions of dollars have been lost by users, and it's quite literally guaranteed that lawyers are foaming at the mouth to be the first to file a class action lawsuit.
    
    Coinkite is a small company, there is quite literally no way under the sun that they will have sufficient funds to support a defense against a class action lawsuit of this magnitude, the outcome of said class action lawsuit is irrelevant because the legal fees for defense alone will bankrupt them.
    
    I think from a hardware perspective, the coldcard is a solid device, but this **is** the end of the company and you will need to come to terms with the understanding that we are all going to be transitioning to "orphan device" status before the end of the year.
    
    This is not an attack on Coinkite or Coldcard, this is just a plain statement of fact.
    
    comment: p13m373
    parent: t3_1vcs0o4
    author: ExplorerBoring9848
    created_utc: 1785603718
    edited: false
    body:
    That's why I'm interested in how best to repurpose the device. 
    
    comment: p13nb6w
    parent: t3_1vcs0o4
    author: YWorkFT
    created_utc: 1785604070
    edited: false
    body:
    Likely score some discount coldcards.
    
    comment: p13o8hc
    parent: t1_p13m373
    author: FaddyDuck5
    created_utc: 1785604334
    edited: false
    body:
    Don't use its RNG. These devices just hold the 12 or 24 silly words we write on paper. 
    
    comment: p13pff6

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  6. Earliest copy held
    seen · Captured here 17,765 chars
    Extracted text as captured
    post: 1vcs0o4
    author: Provia100F
    created_utc: 1785602229
    title: Anyone who thinks Coinkite will remain solvent after the impending class action lawsuit is lying to themselves
    body:
    The devices themselves are probably fine after the firmware update, and apparently dice users are unaffected.
    
    That doesn't change the fact that millions of dollars have been lost by users, and it's quite literally guaranteed that lawyers are foaming at the mouth to be the first to file a class action lawsuit.
    
    Coinkite is a small company, there is quite literally no way under the sun that they will have sufficient funds to support a defense against a class action lawsuit of this magnitude, the outcome of said class action lawsuit is irrelevant because the legal fees for defense alone will bankrupt them.
    
    I think from a hardware perspective, the coldcard is a solid device, but this **is** the end of the company and you will need to come to terms with the understanding that we are all going to be transitioning to "orphan device" status before the end of the year.
    
    This is not an attack on Coinkite or Coldcard, this is just a plain statement of fact.
    
    comment: p13m373
    parent: t3_1vcs0o4
    author: ExplorerBoring9848
    created_utc: 1785603718
    edited: false
    body:
    That's why I'm interested in how best to repurpose the device. 
    
    comment: p13nb6w
    parent: t3_1vcs0o4
    author: YWorkFT
    created_utc: 1785604070
    edited: false
    body:
    Likely score some discount coldcards.
    
    comment: p13o8hc
    parent: t1_p13m373
    author: FaddyDuck5
    created_utc: 1785604334
    edited: false
    body:
    Don't use its RNG. These devices just hold the 12 or 24 silly words we write on paper. 
    
    comment: p13pff6

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.