COLDCARD RNG incident the public record, collected and explained
Informational only, and this site never asks for your seed words. details

Informational only. This is an open source collection of what others have published about the incident, together with an explanation of it. It is not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite. Material is attributed and quoted as published; where sources disagree their scenarios are kept separate with their assumptions rather than reconciled into one answer. Everything is meant to be checked against the linked evidence rather than taken on trust. Act on your own judgement about a particular situation. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it, and contributions containing recovery words or private keys are not accepted.

r/TREZOR: official response to the Coldcard event

reddit-trezor-official-response

https://www.reddit.com/r/TREZOR/comments/1vbjtlo/trezor_users_your_funds_are_safe_cc_related_event/

Latest reviewed change

source content difference between and

The thread gained a new reply from MaxWildman warning that Trezor users' physical safety could be at risk from the ShipMonk PII breach.

seen +10 -0 full history below
 edited: false
 body:
 You need explain more. What kind of phishing, how?
+
+comment: p3r7rft
+parent: t3_1vbjtlo
+author: MaxWildman
+created_utc: 1786754451

First lines only. The complete diff is in the timeline below.

Organisation
reddit
Evidence role
Community discussion
Published
not established
Source changes
1
Detected differences
1
Unreviewed
0
Copies held
2

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .

  1. source content difference between and Current source content +10 -0

    The thread gained a new reply from MaxWildman warning that Trezor users' physical safety could be at risk from the ShipMonk PII breach.

    seen · Captured here 31,132 chars
    What changed from the previous capture 10 lines
     edited: false
     body:
     You need explain more. What kind of phishing, how?
    +
    +comment: p3r7rft
    +parent: t3_1vbjtlo
    +author: MaxWildman
    +created_utc: 1786754451
    +edited: false
    +body:
    +Trezor users: 
    +
    +Your funds are safe. Unless someone breaks into your home and starts breaking your knees with a wrench to force you to hand over your keys because trezor gave out your full name and home address to kidnappers and extortionists.\*
    
    Extracted text as captured
    post: 1vbjtlo
    author: SuchTrezorVeryCrypto
    created_utc: 1785482505
    title: Trezor users: your funds are safe. - CC  related event
    body:
    The recent Coldcard issue is limited to their own custom firmware and how some of their devices generated randomness. Trezor does not share that code.
    
    We have always mixed multiple independent sources of randomness together (device hardware + host + secure elements on newer models). We are truly sorry for everyone who has lost bitcoin.
    
    Stay safe.
    
    Read more on how Trezor generates entropy here:[https://t.co/Nj6xveBQJk](https://t.co/Nj6xveBQJk)
    
    **Important note:**  
      
    If you generated your seed on an affected Coldcard and later moved it to a Trezor, you are still affected. The seed was created with weak randomness on the Coldcard, restoring it elsewhere does not fix that. Please generate a fresh seed on your Trezor and carefully move your funds.
    
    comment: p0tvd7u
    parent: t3_1vbjtlo
    author: AutoModerator
    created_utc: 1785482506
    edited: false
    body:
    Please bear in mind that no one from the Trezor team would send you a private message first.  
    If you want to discuss a sensitive issue, we suggest contacting our Support team via the Troubleshooter: https://trezor.io/support/
    
    **No one from the Trezor team (Reddit mods, Support agents, etc) would ever ask for your recovery seed!**
    Beware of scams and phishings: https://trezor.io/learn/a/scams-and-phishing
    
    Don’t respond to any DMs—scammers often pose as legit helpers.
    
    *I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/TREZOR) if you have any questions or concerns.*
    
    comment: p0uej0q
    parent: t3_1vbjtlo
    author: Green_Bar_8851
    created_utc: 1785491742
    edited: false
    body:
    Thanks for sharing, that article is useful for the community, im glad to choose trezor over other brands.

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  2. Earliest copy held
    seen · Captured here 30,786 chars
    Extracted text as captured
    post: 1vbjtlo
    author: SuchTrezorVeryCrypto
    created_utc: 1785482505
    title: Trezor users: your funds are safe. - CC  related event
    body:
    The recent Coldcard issue is limited to their own custom firmware and how some of their devices generated randomness. Trezor does not share that code.
    
    We have always mixed multiple independent sources of randomness together (device hardware + host + secure elements on newer models). We are truly sorry for everyone who has lost bitcoin.
    
    Stay safe.
    
    Read more on how Trezor generates entropy here:[https://t.co/Nj6xveBQJk](https://t.co/Nj6xveBQJk)
    
    **Important note:**  
      
    If you generated your seed on an affected Coldcard and later moved it to a Trezor, you are still affected. The seed was created with weak randomness on the Coldcard, restoring it elsewhere does not fix that. Please generate a fresh seed on your Trezor and carefully move your funds.
    
    comment: p0tvd7u
    parent: t3_1vbjtlo
    author: AutoModerator
    created_utc: 1785482506
    edited: false
    body:
    Please bear in mind that no one from the Trezor team would send you a private message first.  
    If you want to discuss a sensitive issue, we suggest contacting our Support team via the Troubleshooter: https://trezor.io/support/
    
    **No one from the Trezor team (Reddit mods, Support agents, etc) would ever ask for your recovery seed!**
    Beware of scams and phishings: https://trezor.io/learn/a/scams-and-phishing
    
    Don’t respond to any DMs—scammers often pose as legit helpers.
    
    *I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/TREZOR) if you have any questions or concerns.*
    
    comment: p0uej0q
    parent: t3_1vbjtlo
    author: Green_Bar_8851
    created_utc: 1785491742
    edited: false
    body:
    Thanks for sharing, that article is useful for the community, im glad to choose trezor over other brands.

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.