COLDCARD RNG incident the public record, collected and explained
Informational only, and this site never asks for your seed words. details

Informational only. This is an open source collection of what others have published about the incident, together with an explanation of it. It is not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite. Material is attributed and quoted as published; where sources disagree their scenarios are kept separate with their assumptions rather than reconciled into one answer. Everything is meant to be checked against the linked evidence rather than taken on trust. Act on your own judgement about a particular situation. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it, and contributions containing recovery words or private keys are not accepted.

r/Bitcoin: Blockstream Jade Plus setup workflow suspect

reddit-jade-plus-setup-suspect

https://www.reddit.com/r/Bitcoin/comments/1viknfe/blockstream_jade_plus_setup_workflow_suspect/

Latest reviewed change

source content difference between and

The thread gained a comment saying a Blockstream Jade update can be done via USB stick and explaining a preference not to update air-gapped setups unless a serious vulnerability demands it.

seen +10 -0 full history below
 edited: false
 body:
 Go to Blockstream’s official firmware site (make sure it’s http://jadefw.blockstream.com and not some other dodgy scam site!). Download the latest onto a USB-C drive. Blockstream has its own drive for this called Jadelink but you can use any old drive. Plug this into the Jade, choose the option to update firmware, and just follow the instructions on the device. There is a “no radio” version of firmware that disables bluetooth. Use that one if you want to make sure you never turn on bluetooth accidentally.
+
+comment: p2x21c0
+parent: t1_p2kcsn1
+author: TheresNoSecondBest
+created_utc: 1786397620

First lines only. The complete diff is in the timeline below.

Organisation
reddit
Evidence role
Community discussion
Published
not established
Source changes
1
Detected differences
1
Unreviewed
0
Copies held
2

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .

  1. source content difference between and Current source content +10 -0

    The thread gained a comment saying a Blockstream Jade update can be done via USB stick and explaining a preference not to update air-gapped setups unless a serious vulnerability demands it.

    seen · Captured here 8,496 chars
    What changed from the previous capture 10 lines
     edited: false
     body:
     Go to Blockstream’s official firmware site (make sure it’s http://jadefw.blockstream.com and not some other dodgy scam site!). Download the latest onto a USB-C drive. Blockstream has its own drive for this called Jadelink but you can use any old drive. Plug this into the Jade, choose the option to update firmware, and just follow the instructions on the device. There is a “no radio” version of firmware that disables bluetooth. Use that one if you want to make sure you never turn on bluetooth accidentally.
    +
    +comment: p2x21c0
    +parent: t1_p2kcsn1
    +author: TheresNoSecondBest
    +created_utc: 1786397620
    +edited: false
    +body:
    +You can use a USB stick to do so. 
    +
    +I prefer not to update my air-gapped setups unless there's a huge vulnerability. The wallet is like a big numbers calculator, the math never changes. 
    
    Extracted text as captured
    post: 1viknfe
    author: No_Fuel4693
    created_utc: 1786158158
    title: Blockstream Jade Plus setup - workflow suspect?
    body:
    Like many, I'm assessing my cold wallet options right now and I was watching this youtube video of the setup on the jade plus : [Blockstream Jade Plus: Full Setup & Honest Review - YouTube](https://www.youtube.com/watch?v=gLHsMC7aJj4)
    
    Right around the 9:00 minute mark, after setting up the seed phrase etc, it only then, gives you the option to setup your QR code/bluetooth/usb.  
    
    So the device is powered up, a wallet is created, then you connect to the blockstream website..  
    Is there a way to change the order of that workflow? 
    
    I mean, how do I know that the wallet I have just created isn't being transmitted to their website during this handshake? Wouldn't it make more sense to do all that setup first BEFORE creating the wallet?   
    
    comment: p2e9r7z
    parent: t3_1viknfe
    author: Serbithar
    created_utc: 1786159860
    edited: 1786160144
    body:
    Some Jade users should confirm, but my guess is that, most likely, like with any other wallet, after the first power-up and "initiation" you can go into full offline air gap mode and create a fresh wallet or restore a manually created wallet. New Ledger during the first power-up after the genuineness check anf firmware update also asks you to create a wallet while it is connected to Ledger Live and the internet. But if you distrust the process, you can later just create a fresh wallet when fully offline. I was considering Jade, but decided to choose DIY SeedSigner for for 1/4 or less of Jade's price. But Jade looks like pretty cool device.
    
    comment: p2e9sgh
    parent: t3_1viknfe
    author: DarrelXero
    created_utc: 1786159873
    edited: false
    body:
    Yeah, this is the option to create a seed and use the Jade as a persistent device that is "initialized" and uses Blockstreams Blind Oracle. I agree with you, that sucks. You can 100% create a seed offline, create your QR Code and never once connect to Blockstream website or app. It's how I've used the Jade for years. Generate your seed offline, use the steps to create your QR code and it not be persistent. Temporary signer mode. Power up the Jade, I port the seed via QR, use it to sign transactions or as part of a multisig, then power it off and the device wipes. No need for the Blockstream app or the Blind Oracle.
    
    comment: p2ebj3x
    parent: t1_p2e9sgh
    author: Serbithar
    created_utc: 1786160551
    edited: false
    body:
    If I understand correctly in fully offline airgap mode Jade works exactly like SeedSigner? Keys are not stored, and you need to provide your phrase or scan QR every time you power up the device?
    
    comment: p2ed7w3
    parent: t3_1viknfe

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  2. Earliest copy held
    seen · Captured here 8,201 chars
    Extracted text as captured
    post: 1viknfe
    author: No_Fuel4693
    created_utc: 1786158158
    title: Blockstream Jade Plus setup - workflow suspect?
    body:
    Like many, I'm assessing my cold wallet options right now and I was watching this youtube video of the setup on the jade plus : [Blockstream Jade Plus: Full Setup & Honest Review - YouTube](https://www.youtube.com/watch?v=gLHsMC7aJj4)
    
    Right around the 9:00 minute mark, after setting up the seed phrase etc, it only then, gives you the option to setup your QR code/bluetooth/usb.  
    
    So the device is powered up, a wallet is created, then you connect to the blockstream website..  
    Is there a way to change the order of that workflow? 
    
    I mean, how do I know that the wallet I have just created isn't being transmitted to their website during this handshake? Wouldn't it make more sense to do all that setup first BEFORE creating the wallet?   
    
    comment: p2e9r7z
    parent: t3_1viknfe
    author: Serbithar
    created_utc: 1786159860
    edited: 1786160144
    body:
    Some Jade users should confirm, but my guess is that, most likely, like with any other wallet, after the first power-up and "initiation" you can go into full offline air gap mode and create a fresh wallet or restore a manually created wallet. New Ledger during the first power-up after the genuineness check anf firmware update also asks you to create a wallet while it is connected to Ledger Live and the internet. But if you distrust the process, you can later just create a fresh wallet when fully offline. I was considering Jade, but decided to choose DIY SeedSigner for for 1/4 or less of Jade's price. But Jade looks like pretty cool device.
    
    comment: p2e9sgh
    parent: t3_1viknfe
    author: DarrelXero
    created_utc: 1786159873
    edited: false
    body:
    Yeah, this is the option to create a seed and use the Jade as a persistent device that is "initialized" and uses Blockstreams Blind Oracle. I agree with you, that sucks. You can 100% create a seed offline, create your QR Code and never once connect to Blockstream website or app. It's how I've used the Jade for years. Generate your seed offline, use the steps to create your QR code and it not be persistent. Temporary signer mode. Power up the Jade, I port the seed via QR, use it to sign transactions or as part of a multisig, then power it off and the device wipes. No need for the Blockstream app or the Blind Oracle.
    
    comment: p2ebj3x
    parent: t1_p2e9sgh
    author: Serbithar
    created_utc: 1786160551
    edited: false
    body:
    If I understand correctly in fully offline airgap mode Jade works exactly like SeedSigner? Keys are not stored, and you need to provide your phrase or scan QR every time you power up the device?
    
    comment: p2ed7w3
    parent: t3_1viknfe

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.