COLDCARD RNG incident the public record, collected and explained
Informational only, and this site never asks for your seed words. details

Informational only. This is an open source collection of what others have published about the incident, together with an explanation of it. It is not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite. Material is attributed and quoted as published; where sources disagree their scenarios are kept separate with their assumptions rather than reconciled into one answer. Everything is meant to be checked against the linked evidence rather than taken on trust. Act on your own judgement about a particular situation. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it, and contributions containing recovery words or private keys are not accepted.

r/Bitcoin: why affected COLDCARDs did not produce duplicate addresses

reddit-same-address-collision-question

https://www.reddit.com/r/Bitcoin/comments/1vemf3k/how_come_multiple_same_addresses_werent_created/

Latest reviewed change

source content difference between and

Two comments were removed or replaced with a deleted-account placeholder, including a claim about earlier COLDCARD losses and a statement about hash collisions.

seen +2 -10 full history below
 body:
 lol, a typo obviously. I wrote it correctly the previous sentence.
 
-comment: p1k5nrd
-parent: t1_p1i45ke
-author: OldHamburger7923
-created_utc: 1785804673
-edited: false

First lines only. The complete diff is in the timeline below.

Organisation
reddit
Evidence role
Community discussion
Published
not established
Source changes
4
Detected differences
4
Unreviewed
0
Copies held
5

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .

  1. source content difference between and Current source content +2 -10

    Two comments were removed or replaced with a deleted-account placeholder, including a claim about earlier COLDCARD losses and a statement about hash collisions.

    seen · Captured here 12,660 chars
    What changed from the previous capture 12 lines
     body:
     lol, a typo obviously. I wrote it correctly the previous sentence.
     
    -comment: p1k5nrd
    -parent: t1_p1i45ke
    -author: OldHamburger7923
    -created_utc: 1785804673
    -edited: false
    -body:
    -There was at least two people posting about losing their funds off coldcard in the last few years. 
    -
     comment: p1k5z39
     parent: t1_p1ica5d
    -author: OldHamburger7923
    +author: [deleted]
     created_utc: 1785804775
     edited: false
     body:
    -Hash collisions don't require the exact same inputs. 
    +[deleted]
     
     comment: p1mo5q0
     parent: t1_p1jciij
    
    Extracted text as captured
    post: 1vemf3k
    author: bellydisguised
    created_utc: 1785783305
    title: How come multiple same addresses weren’t created by affected Coldcards?
    body:
    If hackers were able to find these addresses rather easily, and the randomness wasn’t all that random after all, how come there weren’t “random” addresses made for users that were already in use?
    
    comment: p1i40mg
    parent: t3_1vemf3k
    author: groundkittenbeef
    created_utc: 1785783481
    edited: false
    body:
    Wut? 
    
    comment: p1i45ke
    parent: t3_1vemf3k
    author: the_bitcoin_kid
    created_utc: 1785783516
    edited: false
    body:
    Good question. In short, it seems the key space was large enough over the short term to avoid a collision.
    
    There were thousands of customers, but a brute force attack generates far more seeds in a short period of time.
    
    Over a long enough time period there could have been a collision.
    
    comment: p1i51lo
    parent: t3_1vemf3k
    author: qwertyuiop121314321
    created_utc: 1785783743
    edited: false
    body:
    Part of the RNG used boot time from the device. So two users that booted their device at the same time, would cause a possible address collision, having the same addresses.
    
    
    
    
    
    

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  2. source content difference between and source content +8 -0

    1 new Reddit comment was posted, by DragonflyBoom, arguing that different 40-bit inputs cannot collide after expansion to a BIP39 seed.

    seen · Captured here 12,917 chars
    What changed from the previous capture 8 lines
     * **Your Mk3 seed colliding with another among 1 million vulnerable seeds:** about **1 in 1.1 million**
     
     Rare enough to chalk any instances up to user error, not rare enough to say it never happened.
    +
    +comment: p1o9kr3
    +parent: t1_p1k5z39
    +author: DragonflyBoom
    +created_utc: 1785859329
    +edited: false
    +body:
    +ColdCards entropy was 40 bits and a BIP39 seed has at least 128 bits. So it's impossible for two different numbers in the 40 bit range to produce the same hash. You get collisions with larger data sets if they are reduced to 128 bits (which is also very very unlikely).
    
    Extracted text as captured
    post: 1vemf3k
    author: bellydisguised
    created_utc: 1785783305
    title: How come multiple same addresses weren’t created by affected Coldcards?
    body:
    If hackers were able to find these addresses rather easily, and the randomness wasn’t all that random after all, how come there weren’t “random” addresses made for users that were already in use?
    
    comment: p1i40mg
    parent: t3_1vemf3k
    author: groundkittenbeef
    created_utc: 1785783481
    edited: false
    body:
    Wut? 
    
    comment: p1i45ke
    parent: t3_1vemf3k
    author: the_bitcoin_kid
    created_utc: 1785783516
    edited: false
    body:
    Good question. In short, it seems the key space was large enough over the short term to avoid a collision.
    
    There were thousands of customers, but a brute force attack generates far more seeds in a short period of time.
    
    Over a long enough time period there could have been a collision.
    
    comment: p1i51lo
    parent: t3_1vemf3k
    author: qwertyuiop121314321
    created_utc: 1785783743
    edited: false
    body:
    Part of the RNG used boot time from the device. So two users that booted their device at the same time, would cause a possible address collision, having the same addresses.
    
    
    
    
    
    

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  3. source content difference between and source content +13 -0

    1 new Reddit comment was posted, by marvelish, quoting an AI-generated comparison of vulnerable-seed collision odds.

    seen · Captured here 12,544 chars
    What changed from the previous capture 13 lines
     edited: false
     body:
     Yea, but not being called at all effectively results in a very weak RNG. Some RNG was still even in that testing PRNG version that was being called instead, just far less of it. And the device ID was one source of entropy of that weak PRG, making it output at least not always the same thing. But some small space of 2\^40, together with a couple other weak sources.
    +
    +comment: p1nv7vh
    +parent: t3_1vemf3k
    +author: marvelish
    +created_utc: 1785855629
    +edited: false
    +body:
    +from ChatGPT:
    +
    +* **Powerball jackpot:** about **1 in 292 million**
    +* **Your Mk3 seed colliding with another among 1 million vulnerable seeds:** about **1 in 1.1 million**
    +
    +Rare enough to chalk any instances up to user error, not rare enough to say it never happened.
    
    Extracted text as captured
    post: 1vemf3k
    author: bellydisguised
    created_utc: 1785783305
    title: How come multiple same addresses weren’t created by affected Coldcards?
    body:
    If hackers were able to find these addresses rather easily, and the randomness wasn’t all that random after all, how come there weren’t “random” addresses made for users that were already in use?
    
    comment: p1i40mg
    parent: t3_1vemf3k
    author: groundkittenbeef
    created_utc: 1785783481
    edited: false
    body:
    Wut? 
    
    comment: p1i45ke
    parent: t3_1vemf3k
    author: the_bitcoin_kid
    created_utc: 1785783516
    edited: false
    body:
    Good question. In short, it seems the key space was large enough over the short term to avoid a collision.
    
    There were thousands of customers, but a brute force attack generates far more seeds in a short period of time.
    
    Over a long enough time period there could have been a collision.
    
    comment: p1i51lo
    parent: t3_1vemf3k
    author: qwertyuiop121314321
    created_utc: 1785783743
    edited: false
    body:
    Part of the RNG used boot time from the device. So two users that booted their device at the same time, would cause a possible address collision, having the same addresses.
    
    
    
    
    
    

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  4. source content difference between and source content +16 -0

    2 new Reddit comments were posted, including Icy_Giraffe_21,skr_replicator.

    seen · Captured here 12,178 chars
    What changed from the previous capture 16 lines
     edited: false
     body:
     Hash collisions don't require the exact same inputs. 
    +
    +comment: p1mo5q0
    +parent: t1_p1jciij
    +author: Icy_Giraffe_21
    +created_utc: 1785842707
    +edited: false
    +body:
    +RNG wasn't weak. It was never called upon during the creation of the seed. All of coldcards hardware is top notch and sound. They chose not to use it 
    +
    +comment: p1moo6t
    +parent: t1_p1mo5q0
    +author: skr_replicator
    +created_utc: 1785842903
    +edited: false
    +body:
    +Yea, but not being called at all effectively results in a very weak RNG. Some RNG was still even in that testing PRNG version that was being called instead, just far less of it. And the device ID was one source of entropy of that weak PRG, making it output at least not always the same thing. But some small space of 2\^40, together with a couple other weak sources.
    
    Extracted text as captured
    post: 1vemf3k
    author: bellydisguised
    created_utc: 1785783305
    title: How come multiple same addresses weren’t created by affected Coldcards?
    body:
    If hackers were able to find these addresses rather easily, and the randomness wasn’t all that random after all, how come there weren’t “random” addresses made for users that were already in use?
    
    comment: p1i40mg
    parent: t3_1vemf3k
    author: groundkittenbeef
    created_utc: 1785783481
    edited: false
    body:
    Wut? 
    
    comment: p1i45ke
    parent: t3_1vemf3k
    author: the_bitcoin_kid
    created_utc: 1785783516
    edited: false
    body:
    Good question. In short, it seems the key space was large enough over the short term to avoid a collision.
    
    There were thousands of customers, but a brute force attack generates far more seeds in a short period of time.
    
    Over a long enough time period there could have been a collision.
    
    comment: p1i51lo
    parent: t3_1vemf3k
    author: qwertyuiop121314321
    created_utc: 1785783743
    edited: false
    body:
    Part of the RNG used boot time from the device. So two users that booted their device at the same time, would cause a possible address collision, having the same addresses.
    
    
    
    
    
    

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  5. Earliest copy held
    seen · Captured here 11,452 chars
    Extracted text as captured
    post: 1vemf3k
    author: bellydisguised
    created_utc: 1785783305
    title: How come multiple same addresses weren’t created by affected Coldcards?
    body:
    If hackers were able to find these addresses rather easily, and the randomness wasn’t all that random after all, how come there weren’t “random” addresses made for users that were already in use?
    
    comment: p1i40mg
    parent: t3_1vemf3k
    author: groundkittenbeef
    created_utc: 1785783481
    edited: false
    body:
    Wut? 
    
    comment: p1i45ke
    parent: t3_1vemf3k
    author: the_bitcoin_kid
    created_utc: 1785783516
    edited: false
    body:
    Good question. In short, it seems the key space was large enough over the short term to avoid a collision.
    
    There were thousands of customers, but a brute force attack generates far more seeds in a short period of time.
    
    Over a long enough time period there could have been a collision.
    
    comment: p1i51lo
    parent: t3_1vemf3k
    author: qwertyuiop121314321
    created_utc: 1785783743
    edited: false
    body:
    Part of the RNG used boot time from the device. So two users that booted their device at the same time, would cause a possible address collision, having the same addresses.
    
    
    
    
    
    

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.