The data shows a 34-year-old hardware wallet vendor admitting what the industry refused to say: their backup random number generator was cryptographically broken. Coinkite's Coldcard firmware update, released three weeks after a $114 million Bitcoin theft traced to seed-generation flaws, replaced the Yasmarang PRNG with a SHA-256-based construction. But the deeper story isn't the patch. It's what the patch reveals about every hardware wallet on the market.
Context: The Anatomy of a Silent Failure
Coldcard occupies a peculiar niche in the Bitcoin ecosystem. It's the hardware wallet favored by paranoid technologists, the ones who run their own nodes, verify firmware signatures, and refuse to trust anything they can't disassemble. The device's entire value proposition rests on one promise: your private keys never leave secure hardware, and the randomness that generates those keys is beyond compromise.
That promise fractured in July 2026.
The vulnerability lived in the backup RNG path. When the primary entropy source underperformed, Coldcard's firmware fell back to Yasmarang โ a pseudo-random number generator that has no business in cryptographic contexts. Yasmarang's output is predictable. Not "theoretically predictable with enough samples" predictable. Deterministically reconstructable predictable. For a device whose entire security model depends on the unpredictability of seed generation, this was a catastrophic design choice.
The affected window spans 2021 through July 2026. Five years of seeds generated with a compromised fallback. Five years of users believing their keys were the product of true entropy when, under specific conditions, they were the product of a broken algorithm.
Tracing the gas leaks in the 2017 ICO ghost chain taught me that the most dangerous vulnerabilities are never the ones in the primary code path. They're the fallbacks, the error handlers, the "this will never happen" branches that auditors skip.
Core: The Forensic Dissection
Let me walk through what Coinkite actually did, because the fix reveals more than the vulnerability did.
The RNG replacement. Yasmarang is a non-cryptographic PRNG with known statistical weaknesses. Its internal state is small, its output stream exhibits correlations, and given enough consecutive outputs, an attacker can reconstruct the state and predict future outputs. Replacing it with SHA-256 โ a cryptographic hash function whose output is computationally indistinguishable from random โ is the correct move. But here's the uncomfortable question: why was Yasmarang there in the first place?
The answer is embedded in the firmware's architecture. The primary RNG draws from hardware entropy sources โ thermal noise, clock jitter, power fluctuations. The backup RNG existed for scenarios where those sources underperformed. In theory, a fallback should still be cryptographically secure. In practice, Coinkite chose speed and simplicity over security. Yasmarang is fast. It's compact. It's also broken. This is the classic trade-off that security engineers make when they assume the fallback will never be the primary path.
The forced entropy requirement. This is the most interesting part of the update. New seed generation now requires users to provide at least 65 key presses with unpredictable timing, 50 dice throws, or 128 coin flips. Coinkite is forcing physical entropy into the seed generation process, regardless of what the device's RNG produces.
This is a zero-trust design philosophy applied to hardware. The device no longer trusts its own entropy sources. It demands that the user become an entropy source. The logic is sound: even if the RNG is compromised, the user's physical actions โ the timing of key presses, the outcome of dice throws โ inject unpredictability that an attacker cannot predict.
But this creates a new attack surface. Users are now responsible for generating entropy. And users are terrible at generating entropy. A user who presses keys in a rhythmic pattern, or who uses the same dice-throwing sequence every time, is injecting predictable entropy. The device can't distinguish between genuine randomness and patterned behavior. The security model now depends on the user's ability to be random โ which is precisely the failure mode that hardware RNGs were designed to eliminate.
The AI-assisted code review. Coinkite used Kimi, a frontier AI model, to audit the entire firmware โ not just the RNG path. This uncovered additional issues: transaction approval flows, USB data handling, and firmware update verification. The scope of the AI review is notable. Most security audits focus on the code paths that are known to be vulnerable. Coinkite asked the AI to examine everything.
Silicon whispers beneath the cryptographic surface: the AI found what human auditors missed, but it also raises a question about what the AI itself missed.
AI code review has known limitations. It produces false positives. It misses context-dependent vulnerabilities. It can't reason about the interaction between firmware and hardware in the same way a human can. But it can scan thousands of lines of code in minutes, identify patterns that humans would overlook, and flag suspicious constructs for manual review. The question isn't whether AI review is better than human review. It's whether AI review plus human review is better than human review alone. The answer is almost certainly yes.
Transaction re-verification. The firmware now re-verifies the transaction before signing. This addresses a specific attack vector: a compromised host computer that displays one transaction on screen, then swaps the actual transaction data after the user approves. The device now re-checks what it's signing against what the user approved. This is a defense against the "what you see is not what you sign" attack class.
Signature mode restrictions. The update blocks signature modes that allow "subsequent outputs to remain editable." This closes a class of malleability attacks where a signed transaction could be modified after the fact.
Contrarian: The Blind Spots Nobody's Discussing
Here's what the industry isn't talking about: the forced entropy requirement is a UX regression that will create new attack vectors.
Consider the user who generates a new seed. They're told to press keys 65 times with unpredictable timing. What do they do? They press keys in a pattern. Maybe they type their name. Maybe they tap in a rhythm they think is random but isn't. The device can't detect this. The user's "random" input becomes the weakest link in the security chain.
The industry's response to RNG failures has been to push entropy responsibility onto users. This is backwards. The entire point of a hardware wallet is to remove security decisions from humans. Humans are the weakest component in any security system. Forcing them to become entropy sources is a regression, not an improvement.
The better approach would be to use multiple independent hardware entropy sources with continuous health monitoring, and to fail closed โ refuse to generate seeds if entropy quality is insufficient. Coinkite chose to fail open, with user input as the safety net. That's a design decision that prioritizes availability over security.
The code remembers what the auditors missed: Yasmarang sat in that firmware for five years. Five years of code reviews, security audits, and community scrutiny. Nobody caught it. The question every hardware wallet vendor should be asking is not "what else is broken in Coldcard's firmware?" but "what's broken in mine?"
There's also the question of the $114 million. That's the reported theft figure. But the actual number could be higher. The affected window spans five years. Not every user who generated a seed during that window is compromised โ the vulnerability only manifests when the backup RNG path is triggered. But the subset of users who are affected may not know they're affected. The only way to know is to check whether your seed was generated during a period when the backup RNG was active. Coinkite's security status page provides some guidance, but the onus is on users to determine their exposure.
Takeaway: The Industry's RNG Problem Is Structural
This isn't a Coldcard problem. It's a hardware wallet industry problem. Every vendor uses some form of RNG. Every vendor has fallback paths. Every vendor's fallback paths are less scrutinized than their primary paths. The Coldcard incident is the first time a hardware wallet RNG failure has resulted in a nine-figure theft. It won't be the last.
Patching the silence between protocol updates: the fix is deployed, the security page is live, and the migration guides are published. But the deeper vulnerability โ the industry's assumption that hardware RNGs are trustworthy by default โ remains unpatched.
The next generation of hardware wallets needs to treat RNG as a first-class security component, not an implementation detail. That means independent third-party audits of RNG implementations. That means continuous entropy health monitoring with fail-closed behavior. That means cryptographic primitives that are secure by construction, not by convention.
The $114 million question is whether the industry will learn this lesson before the next breach. Based on the evidence, I'm not optimistic. The industry's response to Coldcard has been defensive โ "our RNG is different" โ rather than structural. Until that changes, the silicon will keep whispering, and the funds will keep flowing out.