COLDCARD RNG incident the public record, collected and explained
Informational only, and this site never asks for your seed words. details

Informational only. This is an open source collection of what others have published about the incident, together with an explanation of it. It is not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite. Material is attributed and quoted as published; where sources disagree their scenarios are kept separate with their assumptions rather than reconciled into one answer. Everything is meant to be checked against the linked evidence rather than taken on trust. Act on your own judgement about a particular situation. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it, and contributions containing recovery words or private keys are not accepted.

r/coldcard: dice-roll users on staying with COLDCARD after the incident

reddit-dice-rollers-response

https://www.reddit.com/r/coldcard/comments/1vghhka/coldcard_dice_rollers/

Latest reviewed change

source content difference between and

One earlier comment asking how to watch for this type of attack was removed, and a new hostile exchange mocked users who continue using COLDCARD.

seen +24 -8 full history below 
 
 
 
-comment: p246scw
-parent: t1_p21jzjw
-author: MarkTupper9
-created_utc: 1786042403
-edited: false

First lines only. The complete diff is in the timeline below.

Organisation
reddit
Evidence role
Community discussion
Published
not established
Source changes
6
Detected differences
6
Unreviewed
0
Copies held
7

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .

  1. source content difference between and Current source content +24 -8

    One earlier comment asking how to watch for this type of attack was removed, and a new hostile exchange mocked users who continue using COLDCARD.

    seen · Captured here 35,236 chars
    What changed from the previous capture 32 lines 
     
 
 
-comment: p246scw
-parent: t1_p21jzjw
-author: MarkTupper9
-created_utc: 1786042403
-edited: false
-body:
-How do you prevent or watch out for this type of attack
-
 comment: p24blwq
 parent: t1_p21kboo
 author: FishtailAdvice
 edited: false
 body:
 did 100 dice rolls.  unaffected.  will absolutely stay with the wallet, but concerned the company may not make it thru this crisis
+
+comment: p2x8e4z
+parent: t1_p1x75j2
+author: consultinglove
+created_utc: 1786399419
+edited: false
+body:
+Honestly at this point you deserve to be laughed at. Hackers completely own the platform and you still decide that it's still worth using. So stubborn that you sit in a burning house, you deserve it when you lose everything hah
+
+comment: p2xl598
+parent: t1_p2x8e4z
+author: notthediz
+created_utc: 1786403246
+edited: false
+body:
+Jeeze bro. Who pissed in your cheerios this morning?
+
+comment: p2yifd9
+parent: t1_p2xl598
+author: consultinglove
+created_utc: 1786414043
+edited: false
+body:
+well based on what you’ve said, you’d happily guzzle all the piss in the world if it came from coldcard. Enjoy the technology!
    Extracted text as captured 
    post: 1vghhka
author: EyesFor1
created_utc: 1785958439
title: Coldcard dice rollers
body:
I curious to know how many dice roll users are still on the Coldcard being as they were and are totally unaffected ? Did you leave ? Are you staying ? Will you leave. Dice roll entropy path has been independently verified by a hell of a lot of companies, developers, AI models etc and its safe. Are you staying or going ?

comment: p1x41k8
parent: t3_1vghhka
author: FragileAnonymity
created_utc: 1785958608
edited: false
body:
Dice roll user, no plans on leaving.  

comment: p1x4knf
parent: t3_1vghhka
author: SpareEconomy1849
created_utc: 1785958745
edited: false
body:
Staying but not buying another CK product at this rate.  They'd have to be bought out and C suite gone before I ever think about buying another

comment: p1x5q5b
parent: t3_1vghhka
author: EricJDMBAMD
created_utc: 1785959044
edited: false
body:
Every coldcard is still usable with dice rolls

comment: p1x5vbq
parent: t1_p1x4knf
author: EyesFor1
created_utc: 1785959081
edited: false
body:
I'm staying atm, looking to get anther device but undecided. Main reason is 2 fold, 1 I dont think the company will be around for the long run so updates will cease and 2, even though I know dice rolls are secure this has freaked me out, can't ignore the human emotion, rational or not. 

comment: p1x61ln

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  2. source content difference between and source content +8 -0

    The thread gained a comment from a 100-roll dice user reporting they are unaffected but concerned about Coinkite surviving the crisis.

    seen · Captured here 34,678 chars
    What changed from the previous capture 8 lines 
     edited: false
 body:
 Passphrase is not optional
+
+comment: p2psvgu
+parent: t3_1vghhka
+author: ejon7
+created_utc: 1786309671
+edited: false
+body:
+did 100 dice rolls.  unaffected.  will absolutely stay with the wallet, but concerned the company may not make it thru this crisis
    Extracted text as captured 
    post: 1vghhka
author: EyesFor1
created_utc: 1785958439
title: Coldcard dice rollers
body:
I curious to know how many dice roll users are still on the Coldcard being as they were and are totally unaffected ? Did you leave ? Are you staying ? Will you leave. Dice roll entropy path has been independently verified by a hell of a lot of companies, developers, AI models etc and its safe. Are you staying or going ?

comment: p1x41k8
parent: t3_1vghhka
author: FragileAnonymity
created_utc: 1785958608
edited: false
body:
Dice roll user, no plans on leaving.  

comment: p1x4knf
parent: t3_1vghhka
author: SpareEconomy1849
created_utc: 1785958745
edited: false
body:
Staying but not buying another CK product at this rate.  They'd have to be bought out and C suite gone before I ever think about buying another

comment: p1x5q5b
parent: t3_1vghhka
author: EricJDMBAMD
created_utc: 1785959044
edited: false
body:
Every coldcard is still usable with dice rolls

comment: p1x5vbq
parent: t1_p1x4knf
author: EyesFor1
created_utc: 1785959081
edited: false
body:
I'm staying atm, looking to get anther device but undecided. Main reason is 2 fold, 1 I dont think the company will be around for the long run so updates will cease and 2, even though I know dice rolls are secure this has freaked me out, can't ignore the human emotion, rational or not. 

comment: p1x61ln

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  3. source content difference between and source content +8 -0

    A new reply was added stating that a BIP-39 passphrase is not optional.

    seen · Captured here 34,452 chars
    What changed from the previous capture 8 lines 
     edited: false
 body:
 🫡
+
+comment: p2fyj2h
+parent: t1_p1xt9lh
+author: Impossible_Book_6478
+created_utc: 1786188627
+edited: false
+body:
+Passphrase is not optional
    Extracted text as captured 
    post: 1vghhka
author: EyesFor1
created_utc: 1785958439
title: Coldcard dice rollers
body:
I curious to know how many dice roll users are still on the Coldcard being as they were and are totally unaffected ? Did you leave ? Are you staying ? Will you leave. Dice roll entropy path has been independently verified by a hell of a lot of companies, developers, AI models etc and its safe. Are you staying or going ?

comment: p1x41k8
parent: t3_1vghhka
author: FragileAnonymity
created_utc: 1785958608
edited: false
body:
Dice roll user, no plans on leaving.  

comment: p1x4knf
parent: t3_1vghhka
author: SpareEconomy1849
created_utc: 1785958745
edited: false
body:
Staying but not buying another CK product at this rate.  They'd have to be bought out and C suite gone before I ever think about buying another

comment: p1x5q5b
parent: t3_1vghhka
author: EricJDMBAMD
created_utc: 1785959044
edited: false
body:
Every coldcard is still usable with dice rolls

comment: p1x5vbq
parent: t1_p1x4knf
author: EyesFor1
created_utc: 1785959081
edited: false
body:
I'm staying atm, looking to get anther device but undecided. Main reason is 2 fold, 1 I dont think the company will be around for the long run so updates will cease and 2, even though I know dice rolls are secure this has freaked me out, can't ignore the human emotion, rational or not. 

comment: p1x61ln

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  4. source content difference between and source content +66 -0

    Eight new comments, including one user's account of rolling 200 dice with a passphrase and then pulling everything back to an exchange because trust was lost, moving toward multi-vendor multisig.

    seen · Captured here 34,315 chars
    What changed from the previous capture 66 lines 
     edited: false
 body:
 Yes but you can compare the out put of the dice roll seed phrase generator on coldcard to ian coleman bip 39 tool, seedsigner and specter diy. You can audit the coldcard in an AI LLM and compare forum posts of other users to get as close as you can to answer about the safety of the code without being able to read code yourself. 
+
+comment: p23ubkm
+parent: t3_1vghhka
+author: Best-Tough-9513
+created_utc: 1786039276
+edited: false
+body:
+200 and Gone
+
+comment: p23yr51
+parent: t1_p23ubkm
+author: EyesFor1
+created_utc: 1786040383
+edited: false
+body:
+What do you mean mate ?
+
+comment: p240cvx
+parent: t1_p23yr51
+author: Best-Tough-9513
+created_utc: 1786040782
+edited: false
+body:
+Originally allowed the seeds to be generated by the wallet with a pass phrase , was spared in the first round of swipes, moved to an exchange, then updated the firmware and Rolled over 200, (it was overkill) with a 6 word passphrase, moved it all back to my coldcard with new set up. Slept one night and just nerves got the best of me and I pulled it all back to an exchange. Trust is lost. Moving to a multi vender multisig setup just moving smooth and slow now
+
+comment: p2412es
+parent: t1_p240cvx
+author: EyesFor1
+created_utc: 1786040960
+edited: false
+body:
+I totally understand, device is secure with rolls but human emotion is real. I feel this too. Currently on CC, dice roll, passphrase. Nice and secure but i want out even though its safe. 
+
+
+
+comment: p246scw
+parent: t1_p21jzjw
+author: MarkTupper9
+created_utc: 1786042403
+edited: false
+body:
+How do you prevent or watch out for this type of attack
+
+comment: p24blwq
+parent: t1_p21kboo
+author: FishtailAdvice
+created_utc: 1786043639
+edited: false
+body:
+Yeah I had that’s why I’m migrating
+
+comment: p254ibg
+parent: t1_p212zg3
+author: 4r4nd0mninj4
+created_utc: 1786051204
+edited: false
+body:
+I suspect these devices will be receiving a lot of scrutiny over the next few months. 🤷‍♂️
+
+comment: p2693fv
+parent: t1_p229mju
+author: OneGlassOne
+created_utc: 1786063555
+edited: false
+body:
+🫡
    Extracted text as captured 
    post: 1vghhka
author: EyesFor1
created_utc: 1785958439
title: Coldcard dice rollers
body:
I curious to know how many dice roll users are still on the Coldcard being as they were and are totally unaffected ? Did you leave ? Are you staying ? Will you leave. Dice roll entropy path has been independently verified by a hell of a lot of companies, developers, AI models etc and its safe. Are you staying or going ?

comment: p1x41k8
parent: t3_1vghhka
author: FragileAnonymity
created_utc: 1785958608
edited: false
body:
Dice roll user, no plans on leaving.  

comment: p1x4knf
parent: t3_1vghhka
author: SpareEconomy1849
created_utc: 1785958745
edited: false
body:
Staying but not buying another CK product at this rate.  They'd have to be bought out and C suite gone before I ever think about buying another

comment: p1x5q5b
parent: t3_1vghhka
author: EricJDMBAMD
created_utc: 1785959044
edited: false
body:
Every coldcard is still usable with dice rolls

comment: p1x5vbq
parent: t1_p1x4knf
author: EyesFor1
created_utc: 1785959081
edited: false
body:
I'm staying atm, looking to get anther device but undecided. Main reason is 2 fold, 1 I dont think the company will be around for the long run so updates will cease and 2, even though I know dice rolls are secure this has freaked me out, can't ignore the human emotion, rational or not. 

comment: p1x61ln

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  5. source content difference between and source content +127 -0

    Fourteen new comments: more stay-or-leave reports (one user weighing custody with Bitcoin Suisse), plus criticism of COLDCARD's source-available license, its ngu crypto library, and the risk of nonce-reuse-style signing bugs.

    seen · Captured here 32,624 chars
    What changed from the previous capture 127 lines 
     edited: false
 body:
 Similar thoughts here. Funds are secure. Sit back, research new devices and in the meantime, hopefully no other flaws are found in other device's codes.
+
+comment: p21ax5n
+parent: t1_p1x64on
+author: grraarr
+created_utc: 1786013913
+edited: false
+body:
+Pretty much. With this many eyes on the product it's probably more hardened than any other wallet.
+
+comment: p21ayry
+parent: t3_1vghhka
+author: grraarr
+created_utc: 1786013932
+edited: false
+body:
+I'm staying. Each wallet has its own quirks (not that I'm calling this security event a quirk, just that each one handles the experience differently). People need to realize these are just tools that simplify certain complex realities of cryptography.
+
+comment: p21bnnm
+parent: t3_1vghhka
+author: OneGlassOne
+created_utc: 1786014210
+edited: false
+body:
+I rolled dice. I am staying with coldcard (Q). Mainly because I won't be spending money to buy yet another cold wallet. But given the size of my stack I am contemplating handing a considerable chunk to BitCoin Suisse for safekeeping.
+
+comment: p21jzjw
+parent: t1_p1x75j2
+author: Strong_Judge_3730
+created_utc: 1786017318
+edited: false
+body:
+You know wallets can do other mistakes like signing a transaction in away that it reveals your private key. 
+
+E.g. some Bitcoin wallets re-used the nonce which results in a transaction signature that can reveal the private key https://ishaana.com/blog/nonce_reuse/
+
+If the developers of your hardware wallet are so incompetent they can't even securely generate a seed how can you trust them to sign transactions lol.
+
+Bitcoin might introduce new address formats in the future don't think you no longer need any firmware updates. 
+
+
+comment: p21kboo
+parent: t1_p1xfbye
+author: Strong_Judge_3730
+created_utc: 1786017435
+edited: false
+body:
+Have you heard of nonce reuse
+
+https://ishaana.com/blog/nonce_reuse/
+
+The issue is coldcard is source available instead of being open source, and now we know the company has cowboy devs writing the firmware how can you trust future updates.
+
+comment: p21klxj
+parent: t1_p20h6bn
+author: Strong_Judge_3730
+created_utc: 1786017533
+edited: false
+body:
+It still has dependencies to shit crypto libraries ngu that nobody uses.
+
+You know their devs are shit and the code is not open source, it's source available.
+
+comment: p21o7ry
+parent: t3_1vghhka
+author: Pazienca
+created_utc: 1786018737
+edited: false
+body:
+My funds where safe as I had already around 200 rice dolls, and a passphrase but just to be safe I did it again with a fresh wallet. I will stay with my device as I like it and if you followed the paranoid guide when you first set it up you'd be safe. I am still sad for all the people that got destroyed and I hope coinkite gets sued to shit though. 
+
+comment: p21sjjs
+parent: t1_p1xt9lh
+author: No_Illustrator1837
+created_utc: 1786020099
+edited: false
+body:
+Even if they would offer dice rolls, you still can't be sure. Because you would still be relying on software to process those rolls correctly.
+
+comment: p225n89
+parent: t1_p21bnnm
+author: EyesFor1
+created_utc: 1786023909
+edited: false
+body:
+Considering a split too, multiple wallets can add protection but also add complexity.
+
+comment: p2270rv
+parent: t1_p225n89
+author: OneGlassOne
+created_utc: 1786024282
+edited: false
+body:
+There are no solutions. Only trade offs. Amirite?
+
+comment: p229mju
+parent: t1_p2270rv
+author: EyesFor1
+created_utc: 1786024990
+edited: false
+body:
+Yeah, seems that way. Good luck to you !!!
+
+comment: p22acts
+parent: t3_1vghhka
+author: Provia100F
+created_utc: 1786025187
+edited: false
+body:
+I'm still using my coldcard. It's a very good device from every other perspective.
+
+I transferred all of my coins out except for a few, just to be on the safe side, but I'll move them back once we're all sure of the extent of the issues.
+
+comment: p22o7w2
+parent: t3_1vghhka
+author: cworxnine
+created_utc: 1786028836
+edited: false
+body:
+Dice rolls and apart of multisig, I'm still gonna rotate out the key and ditch coldcard. 
+
+comment: p22ylt4
+parent: t1_p21sjjs
+author: EricJDMBAMD
+created_utc: 1786031477
+edited: false
+body:
+Yes but you can compare the out put of the dice roll seed phrase generator on coldcard to ian coleman bip 39 tool, seedsigner and specter diy. You can audit the coldcard in an AI LLM and compare forum posts of other users to get as close as you can to answer about the safety of the code without being able to read code yourself.
    Extracted text as captured 
    post: 1vghhka
author: EyesFor1
created_utc: 1785958439
title: Coldcard dice rollers
body:
I curious to know how many dice roll users are still on the Coldcard being as they were and are totally unaffected ? Did you leave ? Are you staying ? Will you leave. Dice roll entropy path has been independently verified by a hell of a lot of companies, developers, AI models etc and its safe. Are you staying or going ?

comment: p1x41k8
parent: t3_1vghhka
author: FragileAnonymity
created_utc: 1785958608
edited: false
body:
Dice roll user, no plans on leaving.  

comment: p1x4knf
parent: t3_1vghhka
author: SpareEconomy1849
created_utc: 1785958745
edited: false
body:
Staying but not buying another CK product at this rate.  They'd have to be bought out and C suite gone before I ever think about buying another

comment: p1x5q5b
parent: t3_1vghhka
author: EricJDMBAMD
created_utc: 1785959044
edited: false
body:
Every coldcard is still usable with dice rolls

comment: p1x5vbq
parent: t1_p1x4knf
author: EyesFor1
created_utc: 1785959081
edited: false
body:
I'm staying atm, looking to get anther device but undecided. Main reason is 2 fold, 1 I dont think the company will be around for the long run so updates will cease and 2, even though I know dice rolls are secure this has freaked me out, can't ignore the human emotion, rational or not. 

comment: p1x61ln

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  6. source content difference between and source content +66 -0

    Eight new comments in the stay-or-leave thread: several users report rolling 100+ dice, reseeding and staying with COLDCARD, while others dispute whether the firmware was ever really audited.

    seen · Captured here 28,356 chars
    What changed from the previous capture 66 lines 
     The users who used the TRNG feature didn’t because there was literally nothing to verify..
 
 Using dice, you get the same seed output whether you do it on coldcard or on another source.  So all you would need to do is verify that using the same rolls, coldcard and a second source both yield the same result. 
+
+comment: p20h6bn
+parent: t1_p1xfbye
+author: EyesFor1
+created_utc: 1785999673
+edited: false
+body:
+Ironically, with all the eyes on the new firmware updates, cc is probably one of the safest but no one has trust
+
+
+
+comment: p20heho
+parent: t1_p20h6bn
+author: FishtailAdvice
+created_utc: 1785999782
+edited: false
+body:
+This is completely incorrect. It's clear that no one audits these things. That's what we've learned
+
+comment: p20s08t
+parent: t3_1vghhka
+author: rockpaperbanana
+created_utc: 1786005063
+edited: false
+body:
+Rolled rice over 100 times on the mk4 and the q, I’m not migrating. So many gay doomers on x
+
+comment: p20w60c
+parent: t3_1vghhka
+author: Zestyclose-Way-1351
+created_utc: 1786007143
+edited: false
+body:
+Stay for now, but it'll probably be my last device from them.  May not even be a choice if they, as a business don't survive this.  Reputation and trust is hard to win back. 
+
+comment: p20wppl
+parent: t1_p20s08t
+author: EyesFor1
+created_utc: 1786007421
+edited: false
+body:
+I tend to agree, 100 rolls is secure. 
+
+comment: p20wu41
+parent: t1_p20heho
+author: EyesFor1
+created_utc: 1786007481
+edited: false
+body:
+It was audited a few times, but it was missed. 
+
+comment: p20yl1a
+parent: t3_1vghhka
+author: 4r4nd0mninj4
+created_utc: 1786008352
+edited: false
+body:
+I can't remember how many dice rolls I did in 2021 but it was likely 100 or more. I updated the firmware on Tuesday, deleted the seed, created a new seed and added over 100 rolls and a passphrase. Moved everything to the new wallet with my backup  coldcard yesterday. Seemed to go pretty smoothly. I'm sticking with them until whatever happened is fully investigated and because I don't want to have to deal with buying and dealing with yet another cold wallet vendor. 🤷‍♂️
+
+comment: p212zg3
+parent: t1_p20yl1a
+author: EyesFor1
+created_utc: 1786010462
+edited: false
+body:
+Similar thoughts here. Funds are secure. Sit back, research new devices and in the meantime, hopefully no other flaws are found in other device's codes.
    Extracted text as captured 
    post: 1vghhka
author: EyesFor1
created_utc: 1785958439
title: Coldcard dice rollers
body:
I curious to know how many dice roll users are still on the Coldcard being as they were and are totally unaffected ? Did you leave ? Are you staying ? Will you leave. Dice roll entropy path has been independently verified by a hell of a lot of companies, developers, AI models etc and its safe. Are you staying or going ?

comment: p1x41k8
parent: t3_1vghhka
author: FragileAnonymity
created_utc: 1785958608
edited: false
body:
Dice roll user, no plans on leaving.  

comment: p1x4knf
parent: t3_1vghhka
author: SpareEconomy1849
created_utc: 1785958745
edited: false
body:
Staying but not buying another CK product at this rate.  They'd have to be bought out and C suite gone before I ever think about buying another

comment: p1x5q5b
parent: t3_1vghhka
author: EricJDMBAMD
created_utc: 1785959044
edited: false
body:
Every coldcard is still usable with dice rolls

comment: p1x5vbq
parent: t1_p1x4knf
author: EyesFor1
created_utc: 1785959081
edited: false
body:
I'm staying atm, looking to get anther device but undecided. Main reason is 2 fold, 1 I dont think the company will be around for the long run so updates will cease and 2, even though I know dice rolls are secure this has freaked me out, can't ignore the human emotion, rational or not. 

comment: p1x61ln

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  7. Earliest copy held
    seen · Captured here 26,346 chars
    Extracted text as captured 
    post: 1vghhka
author: EyesFor1
created_utc: 1785958439
title: Coldcard dice rollers
body:
I curious to know how many dice roll users are still on the Coldcard being as they were and are totally unaffected ? Did you leave ? Are you staying ? Will you leave. Dice roll entropy path has been independently verified by a hell of a lot of companies, developers, AI models etc and its safe. Are you staying or going ?

comment: p1x41k8
parent: t3_1vghhka
author: FragileAnonymity
created_utc: 1785958608
edited: false
body:
Dice roll user, no plans on leaving.  

comment: p1x4knf
parent: t3_1vghhka
author: SpareEconomy1849
created_utc: 1785958745
edited: false
body:
Staying but not buying another CK product at this rate.  They'd have to be bought out and C suite gone before I ever think about buying another

comment: p1x5q5b
parent: t3_1vghhka
author: EricJDMBAMD
created_utc: 1785959044
edited: false
body:
Every coldcard is still usable with dice rolls

comment: p1x5vbq
parent: t1_p1x4knf
author: EyesFor1
created_utc: 1785959081
edited: false
body:
I'm staying atm, looking to get anther device but undecided. Main reason is 2 fold, 1 I dont think the company will be around for the long run so updates will cease and 2, even though I know dice rolls are secure this has freaked me out, can't ignore the human emotion, rational or not. 

comment: p1x61ln

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.