COLDCARD RNG incident the public record, collected and explained
Informational only, and this site never asks for your seed words. details

Informational only. This is an open source collection of what others have published about the incident, together with an explanation of it. It is not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite. Material is attributed and quoted as published; where sources disagree their scenarios are kept separate with their assumptions rather than reconciled into one answer. Everything is meant to be checked against the linked evidence rather than taken on trust. Act on your own judgement about a particular situation. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it, and contributions containing recovery words or private keys are not accepted.

r/Bitcoin: first-hand account of catching a bad seed backup before adding passphrase or multisig

reddit-seed-backup-test-first-hand

https://www.reddit.com/r/Bitcoin/comments/1vk1akj/actually_test_your_seed_backup_before_adding/

Organisation
reddit
Evidence role
Community discussion
Published
not established
Source changes
0
Detected differences
0
Unreviewed
0
Copies held
1

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .

  1. Earliest copy held Current
    seen · Captured here 12,534 chars
    Extracted text as captured 
    post: 1vk1akj
author: tomthepooper
created_utc: 1786309527
title: Actually test your seed backup before adding passphrase/multisig. I’m glad I did.
body:
So I had a bit of a wake up call today.

With all the recent Coldcard drama, i started rethinking my own setup. I was planning to improve my custody a bit: add a strong BIP39 passphrase and eventually move toward a more robust multisig setup.

Before doing anything i thought: Let me first check if my current seed backups are actually correct.

I have multiple hardware wallets, each with its own seed. Two of them checked out fine. The third one did not.

I ran the recovery check multiple times. Same result: incorrect seed....

This seed had been stamped into metal months ago. I was pretty sure I had checked it back then. I had evrything labeled, everything looked organized. Still the recovery check failed. Luckily i still had the PIN and access to the wallet, so I was able to move the funds to a wallet with a verified backup. But honestly, this scared the hell out of me. (Imagine the screen had failed or the hardware wallet itself)

The lesson:

A metal backup is not a tested backup. You can stamp words into steel, store them in a safe place, feel secure for months, and still have a useless backup if one word is wrong, swapped, unreadable, or copied incorrectly. Before adding a passphrase, before setting up multisig, before doing anything more complex, check the basics:

\- Run the official recovery check on your hardware wallet.

\- Verify the seed before sending serious funds.

\- Check your backup while the wallet still works.

\- Don’t assume “I wrote it down carefully” means it is recoverable.

\- Don’t wait until the device dies.

I was lucky, i found the problem while I could still move the coins.

If i had discovered this years from now after the device failed, this could have been a disaster.

Not posting this for sympathy. Just a reminder:

Test your backups. Then test them again. Especially before you start adding passphrases or multisig complexity.

comment: p2pud5m

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.