INCIDENT EVIDENCE GRAPH
COLDCARD Incident: When a Wallet's "Random" Seed Wasn't Random
A silent build-and-integration bug in COLDCARD firmware routed Bitcoin seed generation onto a software RNG fallback, whose weak randomness left wallet seeds recoverable offline. Because the weakness is in the seed itself, a firmware update cannot undo it; verified sweeps reached 1,405 BTC (~$91M) by 7 August 2026, with private-channel estimates as high as 2,055 BTC.
- Exploit: COLDCARD firmware software RNG fallback
- Method: Weak randomness in Bitcoin seed generation made wallet seeds recoverable offline