COLDCARD's Random Numbers Weren't

COLDCARD’s random numbers weren’t. A build guard checked whether the hardware RNG macro existed, not whether it was enabled. From March 2021, affected devices could generate wallet seeds from predictable inputs. From 30 Jul to 2 Aug 2026, tracked sweeps took 1,433.13 BTC from 5,477 addresses; destinations received 1,432.48 BTC after miner fees. The plates 01 The sweep 7,346 UTXOs · 2,896 sweeps · 1,432.48 BTC 02 Flow chart 5,477 swept addresses · 613 destinations 03 Routes 1,432.46 BTC still at tracked destinations 04 Address ledger - bc1qxz7s2u…gqgf2451.07 - bc1qhrgyed…w57uvw49.79 - bc1qe85jr4…a2ahlr29.89 5,477 addresses · 7,346 UTXOs 05 Evidence 25 public sources across 10 waves 06 The bug #ifndef HAS_RNG #error "no hardware RNG" #endif #define HAS_RNG 0 satisfies it 128 bits intended · 73.3 at best · 0 at worst 07 How it shipped 4 commits · 2 direct pushes · 0 reviews 08 Timeline five years, first commit to first sweep