r/ledgerwallet: the Coldcard incident and Ledger seed generation
reddit-ledger-official-incident-statement
https://www.reddit.com/r/ledgerwallet/comments/1vi0ut3/the_coldcard_incident_how_ledger_wallet_seed/
Latest reviewed change
source content difference between and
The official statement thread gained a new reply from KIG45 saying the new chip is physically impenetrable even for the government.
Trusting the firmware 100% is literally what got people cold carded.
The passphrase can be used to protect the seed from physical attack too, then it needs to have a different backup method
+
+comment: p38dr1n
+parent: t1_p2gudjw
+author: KIG45
+created_utc: 1786539345
First lines only. The complete diff is in the timeline below.
- Organisation
- Evidence role
- Vendor response
- Published
- not established
- Source changes
- 4
- Detected differences
- 4
- Unreviewed
- 0
- Copies held
- 5
Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .
Also held inside a captured conversation
This post is held twice: here, with this project's own note on why it matters, and again as part of the conversation captured at , which is polled for changes. Both copies are the same post; neither is a separate event.
Public privacy boundary
Snapshot and diff bodies for this chain monitor are held in the local evidence archive but withheld from the public site because they can contain the addresses of people who published nothing themselves. Capture times and reviewed change summaries remain available below.
Held captures
-
The official statement thread gained a new reply from KIG45 saying the new chip is physically impenetrable even for the government.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 8 lines
Trusting the firmware 100% is literally what got people cold carded. The passphrase can be used to protect the seed from physical attack too, then it needs to have a different backup method + +comment: p38dr1n +parent: t1_p2gudjw +author: KIG45 +created_utc: 1786539345 +edited: false +body: +No security advantage, just physically the new chip is impenetrable even for the government.Extracted text as captured
post: 1vi0ut3 author: Steven_Ledger created_utc: 1786109767 title: The Coldcard incident: How Ledger wallet seed generation works, and why weak randomness is invisible body: https://preview.redd.it/nj2ru4hxlyhh1.png?width=1920&format=png&auto=webp&s=4db06c072daed7cebb679b7eb3f2192bb07abdaa # TLDR: Ledger is not affected by the Coldcard Mk3 advisory # What happened Per [Coinkite's advisory](https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/) and [Block's technical analysis](https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware), On July 31st, 2026, Coldcard reported that a firmware bug had weakened how some devices generated seed phrases leading to significant user losses. # Why this specific failure matters Every wallet you create is derived from your Secret Recovery Phrase. If that can be predicted, so can everything built on top of it. A weak Secret Recovery Phrase looks identical to a strong one. Nothing errors, nothing feels wrong, bad randomness is silent. The Secret Recovery Phrase keeps working, but is vulnerable. That is how this survived five years in shipped firmware. # How Ledger devices generate a seed Ledger hardware signers use a true hardware random number generator inside a certified Secure Element, with no software fallback. The generator is compliant with AIS-31/PTG.2, which evaluates the physical entropy source itself rather than just testing whether its output looks random. Every 24-word Secret Recovery Phrase gets the full 256 bits of entropy. >*The generation of that entropy must be anchored in secure hardware, with an architecture that cannot silently downgrade to an untrusted software-based source.* The Secure Element is certified at Common Criteria (EAL5+ for *Ledger Nano S*^(TM) and *Ledger Nano X*^(TM); EAL6+ for *Ledger Nano S Plus*^(TM), *Ledger Stax*^(TM), *Ledger Flex*^(TM) and *Ledger Nano Gen5*^(TM)), and various devices by ANSSI. Producing a predictable random number is listed as Threat #1 in our published security targets, and has been for years. # If you hold a Coldcard Follow[ Coinkite's guidance](https://blog.coinkite.com/update-sunday/) directly, they own that process. # Resources To Learn More One of the key conversations emerging from the Coldcard incident is the value of open source code. Read this response from our CTO on that topic:[ https://x.com/P3b7\_/status/2085089893328499156?s=20](https://x.com/P3b7_/status/2085089893328499156?s=20) We also have an FAQ page that covers questions we’ve seen on social media so far: [https://support.ledger.com/article/FAQs-Related-to-the-Coldcard-Incident-July-2026](https://support.ledger.com/article/FAQs-Related-to-the-Coldcard-Incident-July-2026) comment: p29hz8w parent: t3_1vi0ut3 author: AutoModeratorExcerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
The official statement thread gained new participant comments about passphrase entry and PRNG verification.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 28 lines
It really depends what's your threat model - if it is to protect against an attacker finding a copy of your seed phrase, then it should be long (how long is a good question considering how quickly computes evolve - consider the size of a good password in 2026) - unless you use the raw seed phrase as a decoy, in this case you'd move the assets immediately if it's drained. If it is just to be used as a duress pin, it can be as short as you want + +comment: p2qr85j +parent: t1_p2j4r40 +author: severact +created_utc: 1786320661 +edited: false +body: +Thats the hard part. I would love a feature where you enter your own 23 random words and the ledger device tells you the valid last words and lets you pick one. + +comment: p2zxp9j +parent: t1_p2fdi89 +author: znseta +created_utc: 1786436125 +edited: false +body: +The fact that you cannot test against known values is exactly why it's difficult to verify the quality of a PRNG. It can be hard enough to not find a collision, but still far lower than a cryptographic standard. + +comment: p30k5ad +parent: t1_p2fca7b +author: Strong_Judge_3730 +created_utc: 1786446661 +edited: false +body: +You can literally write it down and leave it next to the seed. + +Trusting the firmware 100% is literally what got people cold carded. + +The passphrase can be used to protect the seed from physical attack too, then it needs to have a different backup methodExtracted text as captured
post: 1vi0ut3 author: Steven_Ledger created_utc: 1786109767 title: The Coldcard incident: How Ledger wallet seed generation works, and why weak randomness is invisible body: https://preview.redd.it/nj2ru4hxlyhh1.png?width=1920&format=png&auto=webp&s=4db06c072daed7cebb679b7eb3f2192bb07abdaa # TLDR: Ledger is not affected by the Coldcard Mk3 advisory # What happened Per [Coinkite's advisory](https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/) and [Block's technical analysis](https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware), On July 31st, 2026, Coldcard reported that a firmware bug had weakened how some devices generated seed phrases leading to significant user losses. # Why this specific failure matters Every wallet you create is derived from your Secret Recovery Phrase. If that can be predicted, so can everything built on top of it. A weak Secret Recovery Phrase looks identical to a strong one. Nothing errors, nothing feels wrong, bad randomness is silent. The Secret Recovery Phrase keeps working, but is vulnerable. That is how this survived five years in shipped firmware. # How Ledger devices generate a seed Ledger hardware signers use a true hardware random number generator inside a certified Secure Element, with no software fallback. The generator is compliant with AIS-31/PTG.2, which evaluates the physical entropy source itself rather than just testing whether its output looks random. Every 24-word Secret Recovery Phrase gets the full 256 bits of entropy. >*The generation of that entropy must be anchored in secure hardware, with an architecture that cannot silently downgrade to an untrusted software-based source.* The Secure Element is certified at Common Criteria (EAL5+ for *Ledger Nano S*^(TM) and *Ledger Nano X*^(TM); EAL6+ for *Ledger Nano S Plus*^(TM), *Ledger Stax*^(TM), *Ledger Flex*^(TM) and *Ledger Nano Gen5*^(TM)), and various devices by ANSSI. Producing a predictable random number is listed as Threat #1 in our published security targets, and has been for years. # If you hold a Coldcard Follow[ Coinkite's guidance](https://blog.coinkite.com/update-sunday/) directly, they own that process. # Resources To Learn More One of the key conversations emerging from the Coldcard incident is the value of open source code. Read this response from our CTO on that topic:[ https://x.com/P3b7\_/status/2085089893328499156?s=20](https://x.com/P3b7_/status/2085089893328499156?s=20) We also have an FAQ page that covers questions we’ve seen on social media so far: [https://support.ledger.com/article/FAQs-Related-to-the-Coldcard-Incident-July-2026](https://support.ledger.com/article/FAQs-Related-to-the-Coldcard-Incident-July-2026) comment: p29hz8w parent: t3_1vi0ut3 author: AutoModeratorExcerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
btchip added a reply about passphrase length trade-offs: long against recovery-phrase exposure, short when used only as a duress PIN.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 10 lines
edited: false body: Thanks, some people say it needs to be a very long and strong word or collection of words. Having “ac1”, “ac2” will be easy to brute force if someone happens to get their hands on the recovery pass phrase isn’t? Isn’t it recommended to be at least 12 characters long? + +comment: p2pcsm7 +parent: t1_p2ne6id +author: btchip +created_utc: 1786304982 +edited: false +body: +It really depends what's your threat model - if it is to protect against an attacker finding a copy of your seed phrase, then it should be long (how long is a good question considering how quickly computes evolve - consider the size of a good password in 2026) - unless you use the raw seed phrase as a decoy, in this case you'd move the assets immediately if it's drained. + +If it is just to be used as a duress pin, it can be as short as you wantExtracted text as captured
post: 1vi0ut3 author: Steven_Ledger created_utc: 1786109767 title: The Coldcard incident: How Ledger wallet seed generation works, and why weak randomness is invisible body: https://preview.redd.it/nj2ru4hxlyhh1.png?width=1920&format=png&auto=webp&s=4db06c072daed7cebb679b7eb3f2192bb07abdaa # TLDR: Ledger is not affected by the Coldcard Mk3 advisory # What happened Per [Coinkite's advisory](https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/) and [Block's technical analysis](https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware), On July 31st, 2026, Coldcard reported that a firmware bug had weakened how some devices generated seed phrases leading to significant user losses. # Why this specific failure matters Every wallet you create is derived from your Secret Recovery Phrase. If that can be predicted, so can everything built on top of it. A weak Secret Recovery Phrase looks identical to a strong one. Nothing errors, nothing feels wrong, bad randomness is silent. The Secret Recovery Phrase keeps working, but is vulnerable. That is how this survived five years in shipped firmware. # How Ledger devices generate a seed Ledger hardware signers use a true hardware random number generator inside a certified Secure Element, with no software fallback. The generator is compliant with AIS-31/PTG.2, which evaluates the physical entropy source itself rather than just testing whether its output looks random. Every 24-word Secret Recovery Phrase gets the full 256 bits of entropy. >*The generation of that entropy must be anchored in secure hardware, with an architecture that cannot silently downgrade to an untrusted software-based source.* The Secure Element is certified at Common Criteria (EAL5+ for *Ledger Nano S*^(TM) and *Ledger Nano X*^(TM); EAL6+ for *Ledger Nano S Plus*^(TM), *Ledger Stax*^(TM), *Ledger Flex*^(TM) and *Ledger Nano Gen5*^(TM)), and various devices by ANSSI. Producing a predictable random number is listed as Threat #1 in our published security targets, and has been for years. # If you hold a Coldcard Follow[ Coinkite's guidance](https://blog.coinkite.com/update-sunday/) directly, they own that process. # Resources To Learn More One of the key conversations emerging from the Coldcard incident is the value of open source code. Read this response from our CTO on that topic:[ https://x.com/P3b7\_/status/2085089893328499156?s=20](https://x.com/P3b7_/status/2085089893328499156?s=20) We also have an FAQ page that covers questions we’ve seen on social media so far: [https://support.ledger.com/article/FAQs-Related-to-the-Coldcard-Incident-July-2026](https://support.ledger.com/article/FAQs-Related-to-the-Coldcard-Incident-July-2026) comment: p29hz8w parent: t3_1vi0ut3 author: AutoModeratorExcerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
The stickied Ledger statement thread gained two new replies: btchip said a BIP-39 passphrase can be as simple as 'ac1' or 'ac2' and can be tied to a PIN as a duress code, and _speedoflight_ questioned whether such short passphrases are strong enough if the recovery phrase is exposed.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 16 lines
edited: false body: For folks who are comfortable to handle passphrase, any tips when setting and managing one? + +comment: p2n08xn +parent: t1_p2jrvtd +author: btchip +created_utc: 1786280395 +edited: false +body: +It can be anything you want, if you want to just create more accounts it could be something as simple as "ac1" "ac2" ... and you can have one associated to a PIN which is nice as a duress code + +comment: p2ne6id +parent: t1_p2n08xn +author: _speedoflight_ +created_utc: 1786284853 +edited: false +body: +Thanks, some people say it needs to be a very long and strong word or collection of words. Having “ac1”, “ac2” will be easy to brute force if someone happens to get their hands on the recovery pass phrase isn’t? Isn’t it recommended to be at least 12 characters long?Extracted text as captured
post: 1vi0ut3 author: Steven_Ledger created_utc: 1786109767 title: The Coldcard incident: How Ledger wallet seed generation works, and why weak randomness is invisible body: https://preview.redd.it/nj2ru4hxlyhh1.png?width=1920&format=png&auto=webp&s=4db06c072daed7cebb679b7eb3f2192bb07abdaa # TLDR: Ledger is not affected by the Coldcard Mk3 advisory # What happened Per [Coinkite's advisory](https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/) and [Block's technical analysis](https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware), On July 31st, 2026, Coldcard reported that a firmware bug had weakened how some devices generated seed phrases leading to significant user losses. # Why this specific failure matters Every wallet you create is derived from your Secret Recovery Phrase. If that can be predicted, so can everything built on top of it. A weak Secret Recovery Phrase looks identical to a strong one. Nothing errors, nothing feels wrong, bad randomness is silent. The Secret Recovery Phrase keeps working, but is vulnerable. That is how this survived five years in shipped firmware. # How Ledger devices generate a seed Ledger hardware signers use a true hardware random number generator inside a certified Secure Element, with no software fallback. The generator is compliant with AIS-31/PTG.2, which evaluates the physical entropy source itself rather than just testing whether its output looks random. Every 24-word Secret Recovery Phrase gets the full 256 bits of entropy. >*The generation of that entropy must be anchored in secure hardware, with an architecture that cannot silently downgrade to an untrusted software-based source.* The Secure Element is certified at Common Criteria (EAL5+ for *Ledger Nano S*^(TM) and *Ledger Nano X*^(TM); EAL6+ for *Ledger Nano S Plus*^(TM), *Ledger Stax*^(TM), *Ledger Flex*^(TM) and *Ledger Nano Gen5*^(TM)), and various devices by ANSSI. Producing a predictable random number is listed as Threat #1 in our published security targets, and has been for years. # If you hold a Coldcard Follow[ Coinkite's guidance](https://blog.coinkite.com/update-sunday/) directly, they own that process. # Resources To Learn More One of the key conversations emerging from the Coldcard incident is the value of open source code. Read this response from our CTO on that topic:[ https://x.com/P3b7\_/status/2085089893328499156?s=20](https://x.com/P3b7_/status/2085089893328499156?s=20) We also have an FAQ page that covers questions we’ve seen on social media so far: [https://support.ledger.com/article/FAQs-Related-to-the-Coldcard-Incident-July-2026](https://support.ledger.com/article/FAQs-Related-to-the-Coldcard-Incident-July-2026) comment: p29hz8w parent: t3_1vi0ut3 author: AutoModeratorExcerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 0 lines
Extracted text as captured
post: 1vi0ut3 author: Steven_Ledger created_utc: 1786109767 title: The Coldcard incident: How Ledger wallet seed generation works, and why weak randomness is invisible body: https://preview.redd.it/nj2ru4hxlyhh1.png?width=1920&format=png&auto=webp&s=4db06c072daed7cebb679b7eb3f2192bb07abdaa # TLDR: Ledger is not affected by the Coldcard Mk3 advisory # What happened Per [Coinkite's advisory](https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/) and [Block's technical analysis](https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware), On July 31st, 2026, Coldcard reported that a firmware bug had weakened how some devices generated seed phrases leading to significant user losses. # Why this specific failure matters Every wallet you create is derived from your Secret Recovery Phrase. If that can be predicted, so can everything built on top of it. A weak Secret Recovery Phrase looks identical to a strong one. Nothing errors, nothing feels wrong, bad randomness is silent. The Secret Recovery Phrase keeps working, but is vulnerable. That is how this survived five years in shipped firmware. # How Ledger devices generate a seed Ledger hardware signers use a true hardware random number generator inside a certified Secure Element, with no software fallback. The generator is compliant with AIS-31/PTG.2, which evaluates the physical entropy source itself rather than just testing whether its output looks random. Every 24-word Secret Recovery Phrase gets the full 256 bits of entropy. >*The generation of that entropy must be anchored in secure hardware, with an architecture that cannot silently downgrade to an untrusted software-based source.* The Secure Element is certified at Common Criteria (EAL5+ for *Ledger Nano S*^(TM) and *Ledger Nano X*^(TM); EAL6+ for *Ledger Nano S Plus*^(TM), *Ledger Stax*^(TM), *Ledger Flex*^(TM) and *Ledger Nano Gen5*^(TM)), and various devices by ANSSI. Producing a predictable random number is listed as Threat #1 in our published security targets, and has been for years. # If you hold a Coldcard Follow[ Coinkite's guidance](https://blog.coinkite.com/update-sunday/) directly, they own that process. # Resources To Learn More One of the key conversations emerging from the Coldcard incident is the value of open source code. Read this response from our CTO on that topic:[ https://x.com/P3b7\_/status/2085089893328499156?s=20](https://x.com/P3b7_/status/2085089893328499156?s=20) We also have an FAQ page that covers questions we’ve seen on social media so far: [https://support.ledger.com/article/FAQs-Related-to-the-Coldcard-Incident-July-2026](https://support.ledger.com/article/FAQs-Related-to-the-Coldcard-Incident-July-2026) comment: p29hz8w parent: t3_1vi0ut3 author: AutoModeratorExcerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
0 presentation-noise differences. Sidebar, ticker and other page chrome churn that our review classified as not being changes to what the source says.
How to check this yourself
The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.
Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.
How to check this yourself
Compare the screenshot or a quotation against the original while it is available.