Why some Coldcard seeds were compromised: false randomness

On July 30th, 2026, some Coldcard hardware wallets were compromised due to false randomness. Coinkite, the company behind the Coldcard, has posted a security advisory here: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/ 

Every bitcoin wallet is built from a large secret random number, represented as a set of words and known as a seed phrase. If that number is truly random, the search space (i.e. the total list of such numbers) is so large that it is nearly impossible for anyone to try them all, even with the computing power of the entire world. But if that randomness is affected, an attacker can easily search for valid keys.

The problem is that computers are bad at randomness, since they are generally deterministic devices. Computers routinely use what are called Pseudo-Random Number Generators (PRNGs) which essentially take some starting number (s) and do mathematical operations to achieve something that looks random but in fact, can be derived if you know the starting conditions. 

For true randomness (TRNG), computers rely on special chips that try to measure external physical entropy such as tiny variations in temperature. The Coldcard has a proper hardware randomness generator built into its main chip, whose entire job is producing unpredictable numbers from physical noise. Until March 2021, the wallet-creation code used it directly.

In March 2021, Coldcard moved its cryptography onto libsecp256k1, the same library Bitcoin Core uses; a sound decision. To do it they added a supporting library, and wallet-seed generation started requesting randomness through that library instead. The library was supposed to work with the same hardware TRNG. However, due to a single mistaken line of code, it reached a software substitute (a PRNG), which looked like it produced randomness, but actually was based on a fixed set of conditions. This set of conditions significantly reduced the total space of randomness, making it possible for an attacker to cycle through all the possible values in a reasonable amount of time.

People who added their own randomness were not affected

Coldcard supports adding your own randomness on top of theirs, to avoid precisely this type of issue (trusting the vendor with randomness). If you created your own seed by drawing words out of a hat, rolling dice, or similar, you were not affected. Coldcard supports two key options to add randomness:

1. Adding a “BIP39” passphrase — this is basically a phrase that comes from your own randomness, outside of the device. If you used a short passphrase like “dog”, that would add very little randomness; an attacker can easily cycle through the dictionary. However, if your passphrase consists of six BIP39 words, it is adding a significant amount of entropy, and making the attack implausible.

2. Using dice. You can roll physical dice, which are a source of true randomness. Note that the company recommends at least 50 dice rolls, but ideally 99 for sufficient entropy. There are some posts saying that commercial dice could be biased, but even a biased source of real world entropy flipped enough times can be sufficient. 
   

Multisig — a safer alternative to relying on a single device

A normal bitcoin wallet holds essentially one secret (the 12 or 24 word seed phrase). Whoever holds that secret controls the money. That means one thing has to go wrong for the money to be gone: the secret is stolen, lost in a fire, guessed, or written down somewhere it shouldn’t have been.

Multisig replaces the single secret with several, and requires a minimum number of them to move funds. The common arrangement is 2 of 3: three separate keys exist, any two can authorise a spend, and no single key can do anything on its own. Think of a safe that needs two different keys turned at once, held by two people who keep them in different buildings. Here at Swan, we offer Swan Vault, where you hold two hardware keys, and you manage the operation of the third backup key via the Swan platform. This makes the setup highly resilient to theft and loss. Our supported device, the Blockstream Jade, is not affected by the Coldcard bug, according to Blockstream. In fact, the Jade relies on several totally independent sources of randomness to avoid precisely this type of issue.

Astute readers may notice a catch — if the same type of device running the same firmware was used to create the majority of the multisig setup’s keys, and a flaw similar to the Coldcard flaw was found, an attacker could potentially re-create the seeds of those devices. A multisig setup generates multiple addresses like any other Bitcoin wallet. Each address is a fingerprint of a lock design, not a list of keys. When you receive Bitcoin to an address, you reveal nothing about which keys open it, how many are needed, or who holds them. 

An attacker cycling through random Bitcoin keys in a large scale attack doesn’t necessarily know they belong to a multisig. Even if they accidentally stumbled on your specific two keys, they can’t compute your address, because computing it requires the third key as well, and they don’t have it.

However, when you spend from a multisig address, you have to publish the lock design so the network can verify it. That publication reveals the public versions of all three keys, which is the information the attacker needs (along with the two private keys they already presumably cracked). This information is available to the attacker as soon as you initiate the spend, because your transaction enters into the Bitcoin mempool, a temporary holding place on every Bitcoin network node that processes transactions, and thus becomes visible to all. An attacker could duplicate your transaction, but pay a higher fee, to get their transaction included.

Because of this, if you created a multisig with two vulnerable Coldcards (i.e. not using passphrases and dice, Mk3 version 4.0.1 or later), you should transfer your funds to a safer setup. However, although relatively unlikely, the act of sending the Bitcoin could itself expose it to the attack. For this reason, you may consider using a private Bitcoin relay service such as MARA Slipstream (https://slipstream.mara.com/) to submit the transaction. This is an advanced operation, but most people who have set up multisig quorums using Coldcards are probably advanced enough to proceed with this. 

Self custody is the preferred path for Bitcoiners, but you don’t need to rush into it

If you are worried about the safety of your setup, you may want to consider placing your assets with a custodian. There are a number of options on the market. Here at Swan, we have partnered with reputable regulated financial institutions such as BitGo, Bakkt, and Equity Trust, each of which holds funds directly in your name, and in highly secure facilities. 

Swan offers a spectrum of custody options due to the trade-offs of all the options, 

• self custody,

• guided self custody with Swan Sovereign, 

• regulated institutional custody with Swan Safe, 

• collaborative multi-sig custody with Swan Vault, 

• and additional layers of protection with video baseline and verification of Swan Safe Plus and Swan Vault Plus. 

Many clients move between these options or split their Bitcoin holdings between them. See https://www.swanbitcoin.com/custody/ to learn more. 

And all these custody options are further secured by Swan Guard, our suite of advanced security features and protocols that protects all Swan accounts. 

As always, we are here to help. Reach out to us at hello@swanbitcoin.com or your Swan Private rep.