Coldcard's RNG Flaw: A Forensic Look at the Trust Assumption

The firmware update landed on August 20. Coinkite pushed version 5.6.1 for Mk4 and Mk5, and 1.5.1Q for the Q model. The patch note was terse: mandatory manual entropy injection for seed generation. The reason, buried in a security advisory, was a random number generator defect that could, under specific conditions, produce predictable private keys. Data does not lie; it only reveals hidden patterns. The pattern here is not just a bug—it is a structural failure in the hardware wallet's core trust model. Context: Coldcard has long positioned itself as the bitcoin maximalist's fortress. Air-gapped signing, open-source firmware, and a fanatical focus on physical security. Its user base is not the average retail investor; it is the security-conscious holder, the paranoid whale, the custody service that relies on deterministic key generation. The RNG is the foundation of that fortress. If the entropy source is compromised, every key derived from it is suspect. Coinkite's advisory, combined with an independent analysis from Block (the payments company, not the block), traced the root cause to a code logic error: a feature flag defined as zero was treated as present, routing requests to a deterministic MicroPython fallback. This is not a hardware design flaw—it is a software routing mistake with catastrophic consequences. Core: My own audit experience, dating back to the 2017 ERC-20 token standard reviews, taught me to verify claims against implementation. Here, the implementation is the firmware. The critical data point is that the fix does not retroactively add entropy to already-generated seeds. Users must migrate funds. The migration process is not trivial: it requires generating a new seed using physical randomness—50 dice rolls or 128 coin flips—entered via 65 button presses on the device. This is a deliberate shift from trusting hardware RNG to trusting user-performed physical randomness. The security assumption has moved from a chip's internal entropy to a human's ability to execute a fair, private, and independent random process. That is a stronger user responsibility assumption, and it introduces a new failure vector: user error. The firmware also includes additional hardening: USB review, PSBT validation, SIGHASH_SINGLE restrictions, and a persistent RNG failure stop. These are welcome, but they do not address the underlying RNG path. The fix is a workaround, not a cure. Block's analysis boundary was broader than Coinkite's own, suggesting the vendor may have underestimated the affected firmware versions. That discrepancy is a red flag. If the vendor's own scope is narrower than a third party's, the full blast radius is unknown. Contrarian: The market reaction will focus on brand damage and user migration risk. But the deeper issue is the industry's narrative that hardware wallets are inherently secure. This event proves that security is a process, not a product. The contrarian angle: the forced manual entropy might actually be a security improvement over the previous model. Hardware RNGs are black boxes; users never verified their output. Now, users are forced to inject physical randomness, which is auditable and verifiable. The old model was trust-the-chip; the new model is trust-the-user. Neither is perfect, but the new one at least allows for independent verification. The real blind spot is the migration itself. Users who fail to follow the dice-roll protocol correctly—using biased dice, performing the process in a non-private setting, or making transcription errors—will generate weak seeds. The vulnerability is not fixed; it is transferred from the device to the human. Correlation is not causation: the RNG bug caused the crisis, but the migration process will cause the next one. Takeaway: The next signal to watch is Coinkite's disclosure of verified victim counts and total losses. As of now, they have not published those numbers. That silence is data. In my 2022 LUNA post-mortem, I traced 60% of the initial outflow to twelve institutional addresses. Here, the outflow is user trust. If Coinkite fails to provide transparent loss data within the next two weeks, expect further erosion. The industry will also see a push for third-party RNG audits as standard practice. For affected users, the only safe action is to migrate immediately, using a test transaction first. The dice are now the firewall. Roll them carefully.