The metadata whispers what the contract screams. On July 2026, Coinkite published a firmware update for its flagship Coldcard hardware wallet. The accompanying advisory buried the headline: the device's backup random number generator (RNG) had been running a non-cryptographic pseudo-random algorithm—Yasmarang—for nearly five years. Between 2021 and July 2026, anyone who generated a seed under specific conditions was exposed to a predictable entropy source.
The outcome: $114 million in Bitcoin stolen from affected wallets.
Silence in the logs is louder than any statement. The event is not just a bug report. It is a thesis on how hardware wallets—the industry's "unhackable" fortress—can fracture from within.
Context: The Coldcard, The Auditor, The Blind Spot
Coldcard is a Canadian-made, Bitcoin-only hardware wallet developed by Coinkite. Its reputation rests on extreme security: air-gapped operations, full-disk encryption, and open-source firmware. It is the preferred tool of Bitcoin maximalists and security professionals who distrust multi-currency devices.
The vulnerability centered on the backup RNG path. Hardware wallets use internal RNGs to generate seed phrases—the keys to your funds. If a single RNG is flawed, all generated keys are theoretically forgeable. Coinkite's primary RNG was fine. The backup path, however, relied on Yasmarang—a PRNG with known statistical weaknesses.
The attack vector is straightforward: an attacker who identifies your device's seed generation window and the entropy source can predict the output. For affected users, this means their wallet's security assumption—that randomness is unguessable—was void.
The Forensic Teardown: What Was Broken, What Was Fixed
The Core Vulnerability Yasmarang produces a sequence with a periodic bias. Under a high-volume output, an attacker can model the state and predict subsequent values. This is not a theoretical exploit. In practice, it allowed for targeted predictions against wallets that generated seeds during the affected firmware window.
The Fix Coinkite's firmware update performs a triple-layer entropy injection:
- Replace the backup RNG with SHA-256-based hashing. SHA-256 is not a PRNG by itself, but when seeded with sufficient entropy, it serves as a strong random source. This is a proven construction.
- Force user entropy input. For new seed generation, the user must provide a minimum of 65 keypresses (with unpredictable timing), 50 dice rolls, or 128 coin flips. This is a manual, physical entropy addition. It removes the dependency on device internal randomness. The user becomes the hardware RNG.
- Re-verification before signing. The device now re-checks the pending transaction right before signing, mitigating a compromised host USB path that could alter payment details after user approval.
The AI Review Coinkite also used AI-based code review on the entire system—not just the RNG path. The model reportedly flagged issues in transaction approval, USB data handling, and firmware update validation. This is an industry-first in transparency, but the caveat is clear: AI audits are assistive, not authoritative. They can miss subtle cryptographic flaws that require human reasoning.
The Contrarian Angle: What the Bulls Got Right
The common narrative after such events is "hardware wallets are dead." That's a lazy conclusion.
Here's the counter-intuitive part: Coinkite's forced-entropy model is a step forward, not backward. Most wallets rely on silicon-based RNGs that are opaque to the user. You can't audit a chip. Coldcard now gives you a measurable, physical entropy input—dice, coins, keypress timing. This is auditable. It shifts trust from "our chip is secure" to "you generated the seed with your own hands."
The bulls are also right about the AI review. Using large-scale code review across the entire firmware is not common practice. It found real bugs beyond the RNG. The project's response was transparent, with a public status page and a firmware update within three weeks. That speed and disclosure are not typical of a failing project.
But the blind spot remains: the vulnerability existed for five years. AI review only started after a catastrophic theft. The real lesson is that security auditing must be continuous, not post-event.
The Takeaway: Entropy Is a Trust Boundary
This event is not just about Coldcard. It is a signal for the entire hardware wallet industry.
The silent takeaway is this: user-supplied entropy is the only uncorrelated source. If a device's RNG is compromised, the user must be able to compensate. Coldcard's new model may be inconvenient, but it is robust.
For users holding affected Coldcard devices: the migration is non-negotiable. Generate a new seed using the new firmware, move funds immediately. Do not attempt a shortcut. The migration process itself is a new attack surface.
For the industry: the next frontier is user-controlled entropy and independent verification. Hardware wallets must move from "security by brand" to "security by mathematics." The question is not if the next vulnerability will be found, but whether the industry will adopt the user-centered entropy model before the next $1 billion theft.
The image is static; the provenance is a phantom. Check the dice, not the logo.