Coldcard's RNG Breach: When the Fallback Becomes the Failure

The system failed because a feature flag was defined as zero. Not undefined. Not throwing an error. Just zero. And in MicroPython, that was enough to route the random number generator down a deterministic path. Block's independent analysis traced the Coldcard vulnerability to this specific logic flaw: code that treated a zero-valued flag as present, triggering a fallback to a deterministic RNG. That's it. The entire security apparatus of a flagship hardware wallet was compromised by a boolean check that couldn't tell the difference between "off" and "broken." For a company that built its reputation on air-gapped signing and paranoid security, this is the kind of failure that makes users question every assumption they've held. The chain didn't fail. The silicon didn't fail. The code did. And that's worse, because code is supposed to be auditable. Code is supposed to be testable. Code is supposed to have guards against exactly this kind of silent degradation. Context matters here. Coinkite announced the vulnerability on August 20th, pushing firmware updates for the Mk4 and Mk5 (version 5.6.1) and the Q (version 1.5.1Q). The affected models include the older Mk2 and Mk3, which are no longer supported. The flaw: under specific conditions, the device's RNG would produce predictable output, compromising the entropy of generated seeds. An attacker who could predict the seed could derive the private keys. Total loss of funds. The root cause, as detailed by Block's analysis, was a code path that routed requests to a deterministic MicroPython fallback because a zero-defined feature flag was interpreted as existing. This is a classic defensive programming failure. The code assumed that if the flag was present, it was functional. It never checked the value. It never validated the state. It just trusted the structure and moved on. This is what I've seen in countless smart contract audits. Developers write code for the happy path, then add fallbacks for edge cases without fully considering what those fallbacks mean. A fallback that compromises security isn't a fallback. It's a trap door. Here's the core issue: Coinkite's patch doesn't fix the underlying RNG problem. It bypasses it. The new firmware forces users to add manual entropy during seed generation. Mk4/Mk5 users must roll a physical die 50 times, or flip a coin 128 times, or press random buttons 65 times. The Q requires 100 button presses. This is a workaround, not a fix. The hardware RNG is still suspect. The code that routes to it is still suspect. Coinkite has simply added a manual override that ensures at least some entropy comes from the physical world. I've spent years testing DeFi protocols, and this pattern is all too familiar. When a system's core component fails, the quickest patch is to add redundancy. But redundancy doesn't address the root cause. It just masks it. The RNG defect remains. The logic flaw remains. The only thing that changed is the user's burden. Now, instead of trusting the device, you have to trust yourself to correctly execute 50 dice rolls without bias, without observation, without error. That's not a security upgrade. That's a shift of responsibility. The new security model assumes the user can be a reliable source of entropy. But humans are terrible at randomness. We have biases. We have patterns. We get tired. We get distracted. A user who rushes through 50 dice rolls, or who doesn't properly mix the dice, could introduce predictability into the seed generation process. The firmware also introduces several other security hardening measures: USB stack review, PSBT validation, SIGHASH_SINGLE restrictions, and a persistent RNG failure halt. These are good steps. But they're incremental improvements, not fundamental fixes. The device now fails closed when RNG issues are detected. That's the right instinct. But it doesn't change the fact that the damage has already been done. Here's what's not being talked about enough: the fix is not retroactive. New firmware cannot add entropy to seeds that were already generated. Every affected user must migrate their funds to a new wallet with a newly generated seed. That means creating a new seed, moving funds, and verifying everything works. For users with significant holdings, this is a nerve-wracking process. The migration guide is detailed, but the risk of user error is high. I've seen this before. When a protocol has a critical vulnerability, the response is always "migrate to the new contract." But migration is where users get hurt. They make mistakes. They lose their seed phrases. They send funds to the wrong address. The vulnerability itself might not be what causes the loss. The migration does. The contrarian angle here is uncomfortable. Block's analysis boundary was broader than Coinkite's. That suggests Coinkite may not fully understand the scope of the problem. If a third-party auditor identifies more affected firmware versions than the manufacturer did, you have to ask: what else don't they know? The vulnerability may have been exploited before disclosure. Some customers have already suffered significant losses. But Coinkite hasn't published verified victim numbers or total loss amounts. That's a transparency gap. In a security incident of this magnitude, users deserve to know the full scope of the damage. The silence on this front is concerning. The industry should take note. This event undermines the "hardware wallet absolute security" narrative. If a device as security-focused as Coldcard can have an RNG flaw, what about the others? Ledger and Trezor also rely on hardware RNG. They also have complex firmware. They also make assumptions about what can go wrong. Here's what I've learned from auditing smart contracts: the most dangerous bugs are the ones that don't fail loudly. A silent failure in an RNG is the worst possible outcome because users believe their funds are secure when they're not. They generate seeds. They store them. They go about their lives. All the while, an attacker with enough resources and knowledge could be deriving their private keys. For affected users, the priority is clear: migrate immediately. Follow the official guide. Use small test transactions first. Verify addresses multiple times. But also understand that the new security model depends on your ability to generate physical randomness correctly. Take it seriously. Don't rush. For the industry, this is a wake-up call. Hardware wallets need independent audits of their RNG implementations. They need fault injection testing. They need to prove that their fallbacks are secure, not just functional. A feature flag that silently degrades to a deterministic RNG is a design flaw that should have been caught in code review. The vulnerability forecast is clear. This will not be the last hardware wallet security incident. The pressure on manufacturers to ship features faster will continue to create attack surfaces. The question is not whether another flaw will be found. It's when, and in which device. Coinkite's response has been relatively transparent. They acknowledged the issue, released patches, and provided migration guidance. But the damage to their brand is done. The trust deficit is real. For a company that markets itself as the most secure option, an RNG flaw is existential. The next few months will tell the story. Will Coinkite publish the full technical report? Will they disclose victim numbers? Will they commission external audits? The answers will determine whether they can rebuild trust or whether they'll lose market share to competitors. Coldcard's RNG breach is a reminder that security is not a feature. It's a process. It's a culture. It's a set of practices that must be continuously maintained and verified. And when the code fails, everything else fails with it. The chain didn't break. The cryptography didn't break. The code did. And that's the most humbling failure of all.