COLDCARD RNG Incident (2026) refers to the secret-generation flaw disclosed in July 2026 and its remediation. The model, firmware track and version when the seed was created, its origin and any independent entropy matter. This was neither remote takeover of the device nor a Bitcoin consensus flaw.
Coinkite and Block published their initial analyses on July 30, 2026 following reports of losses. The manufacturer describes attackers deriving weak private keys offline, not remotely controlling devices. A wallet brand alone cannot establish the cause of an individual loss. Read the technical record and later guidance with their revision dates. [Coinkite — COLDCARD Security Advisory] [Block — Predictable RNG Fallback and 32-Bit Reseed]
After the move to libNgU, ngu.random.bytes reached MicroPython’s rng_get and its Yasmarang generator. MICROPY_HW_ENABLE_RNG was set to 0; however, #ifndef checked whether the macro existed, not whether the hardware path was enabled. The intended TRNG code could be present in the binary without being used for seed generation. A hardware failure did not trigger an emergency fallback at runtime. [Coinkite — Technical Deep Dive into the Entropy Issue]
Software state came from device data, timers and call history. For Mk4, Mk5 and Q, Block describes an additional reseed limited to 32 bits: at most 2^32 distinct streams when the remaining state is fixed. Coinkite gave preliminary total estimates of roughly 40 bits for Mk2/Mk3 and 72 bits for newer models. These figures use different assumptions; they cannot establish a universal attack cost or show that every wallet can be broken immediately. [Block — Predictable RNG Fallback and 32-Bit Reseed] [Coinkite — Technical Deep Dive into the Entropy Issue]
Official guidance lists Mk2/Mk3 4.0.1–4.1.9. Block’s initial analysis includes 4.0.0 and the change in March 2021; we explicitly retain this discrepancy in the record. For an uncertain seed origin, the migration guide recommends taking the cautious migration path. Mk4/Mk5 and Q were affected before their track’s fix. The initial analysis’s old statement about all production versions does not describe today’s fixed releases. [Coinkite — COLDCARD Security Advisory] [Block — Predictable RNG Fallback and 32-Bit Reseed] [COLDCARD — Seed migration guide]
Minimum fixes are Mk2/Mk3 4.2.0, Mk4/Mk5 Standard 5.6.0, Q Standard 1.5.0Q, Mk4/Mk5 Edge 6.6.0X and Q Edge 6.6.0QX. Versions across tracks cannot be compared as one sequence. At this review, the status page recommends Standard 5.6.2 for Mk4/Mk5 and 1.5.2Q for Q. Before installation, check the current official page, release hash and signature; a higher number on another track is insufficient. [COLDCARD — Current Security Status]
Deterministic hashing can change an output’s appearance but cannot enlarge the set of possible inputs. BIP39 Checksum does not add missing entropy either. A securely generated external seed is not weakened by this incident merely by being imported into a COLDCARD. Conversely, an affected seed remains affected after restoration on another device; an update, cloning or transfer feature does not make it a new seed. [Block — Predictable RNG Fallback and 32-Bit Reseed] [COLDCARD — Seed migration guide]
The manufacturer’s exception requires at least 50 fair, independent and private rolls entered through the original Add Dice Rolls workflow and use of the final words shown afterwards. With fewer rolls or uncertainty, it recommends migration. A strong, unique BIP39 Passphrase adds a barrier but does not repair a weak seed; the manufacturer also recommends migration for its users. A PIN is not a passphrase. Current new-seed requirements must be distinguished from this historical exception. [Coinkite — COLDCARD Security Advisory]
The current guide requires checking backups, installing the appropriate fix, creating a genuinely new seed, checking the fingerprint and receive address on the device, and making a small test transaction. Move the remaining funds only after verifying the new destination. Retain the old backup until migration is fully confirmed and account for every funded account, passphrase wallet, derived child and multisig policy. If something does not match, erase or send nothing; private recovery material does not belong in a web form. [COLDCARD — Seed migration guide]
Multisig is not an automatic exception: enough compromised signing keys can satisfy the old policy’s threshold. Assess the remaining secure keys and verify the replacement policy. Block also identifies other consumers of the same randomness, such as standalone paper-wallet keys and some temporary encryption keys. Severity depends on the particular protocol and available data; the impact is not identical for every feature. [Block — Predictable RNG Fallback and 32-Bit Reseed] [COLDCARD — Seed migration guide]
The status page distinguishes a hardware-RNG test on a real Mk4, source reviews and a reproduced build of a specific fix. These are bounded checks of the path and mechanism, not a complete audit of every binary or proof that all bugs are absent. Current Standard firmware additionally requires user-contributed entropy; the old claim that it is always optional would be misleading. The page still describes a separate detailed postmortem as being prepared. [COLDCARD — Current Security Status]
New firmware, but still the original seed
A user created a seed on Mk3 4.1.9 without personal dice rolls. Later they installed 4.2.0 and restored the same words on another device. This did not change the seed’s origin. They assess remediation using the migration guide: a new securely generated seed, verified backup and address, a test transfer and only then transfer of the remainder. They keep the old backup until all funds are confirmed.
For the clearest picture, read this entry together with Cryptographic Entropy, Deterministic RNG, Seed Generation, BIP39 checksum, BIP39 passphrase, Dice Roll Entropy.
01Is updating firmware or buying a new wallet enough?+
No. Neither step changes an existing seed. Where and how it was generated matters. Affected funds must be addressed under the migration guidance and the exact independent-dice exception; simply restoring the same words does not remove the problem.
02Does the 32-bit figure mean attacks are equally easy on every model?+
No. In Block’s analysis, it limits the additional reseed with the remaining state and call history fixed. Unknown device data or timing changes the attacker’s work. The estimate is neither a universal benchmark nor proof that a particular affected seed is safe.