Coldcard and the limits of “don't trust, verify”

Like a lot of Bitcoiners, I’ve spent much of the last few days processing the Coldcard revelations and trying to spread the word. If this is the first you’re hearing of it, and you’re unsure whether you’re safe, take action now.

Now that my initial shock has worn off - and assuming you, dear reader, have taken all necessary steps to secure your bitcoin - I wanted to try and articulate my thoughts on the situation and what it means for Bitcoin self-custody.

How we got here

For the full story, check the excellent write-ups by Block and Wizardsardine. I’ve summarised it below. Given Bitcoiners’ propensity for detailed threat modelling, the reality is almost too mundane to believe.

Coldcard’s firmware switched off MicroPython’s built-in random number generator (RNG) with a build flag, MICROPY_HW_ENABLE_RNG = 0, the intention being to use the STM32’s hardware-based RNG directly instead. But the library underneath checked whether that flag was defined, not what it was set to. Setting it to zero didn’t disable anything. This quietly routed seed generation into Yasmarang, MicroPython’s software-based pseudo-random number generator (PRNG). While random-looking, the output of a PRNG is actually deterministic - a bit like a hash. In this case, the inputs were the device’s serial number and internal clock. Predictable inputs, and therefore a brute-forceable output.

This sat harmlessly in the config until March 2021, when Coldcard moved its elliptic-curve operations to libsecp256k1. Doing so required adding libNgU, an embedded MicroPython library. A single commit - cheerfully titled “First pass w/ libNgU” - changed wallet generation from rng_bytes(seed) to ngu.random.bytes(32), which resolved to MicroPython’s software fallback. The mistake reached customers in firmware 4.0.1, and sat there, in a public code repository, for over five years.

On the Mk2 and Mk3, that’s the whole story: nothing else was mixed in. An attacker who knows a device’s serial number is left guessing only its millisecond timer (around 80k possibilities in the best case for attacker). Newer devices like the Mk4 do mix in entropy from the secure element, but hash it and retain only four bytes, capping the number of possible seeds at 2³², or 4 billion. If either number sounds like a lot to you, take a look at my interactive guide to entropy.

Could this have been disclosed responsibly?

Obviously the thief is the villain here. But the nature of this vulnerability means responsible disclosure would’ve been extremely difficult. This isn’t an issue that can be retroactively patched by updating firmware - any seed generated by a flawed Coldcard is permanently vulnerable. There will be a long tail of Coldcard-based addresses drained over the months to come, much like the slow bleed of brain wallets a decade ago. The only way to protect your coins is to move them to an entirely new wallet.

So if this vulnerability had been discovered by a decent human being, what would their options have been? Disclosure to Coinkite? Powerless to fix. Disclosure to senior folks at Anchorwatch, Casa, Unchained, and so on - could they have coordinated a mass migration of funds without word getting out? Not indefinitely, but likely for long enough to protect some of the people who’ve now lost their life savings.

Some have floated the idea of a white-hat confiscation - a pre-emptive sweep of vulnerable wallets, held in escrow for their owners - but this overlooks how difficult identifying and proving legitimate ownership would be. Now that anyone can derive these seeds, possession of the keys proves nothing about who owned them - I can smell the lawsuits from here. This will be a problem should any funds be recovered in the weeks to come, and is precisely why victims of this crime should not dispose of their affected devices. Retain anything which could help prove ownership.

In short, I see no world in which this mistake was resolved without funds getting stolen.

The ones who made it possible

Which brings me to the next question: who’s ultimately responsible for this, besides the thief?

The answer is Coinkite. Generating entropy is the single most important job a Bitcoin wallet has, and the manner in which this catastrophic mistake was introduced reveals sheer negligence. Pointing the finger at “a complex and subtle series of bugs” (to quote their postmortem), or at AI (for assisting in discovery of the issue) is an abdication of responsibility.

This is what customers paid for versus what they received:

The fact that Coinkite’s co-founder Rodolfo (“NVK”) has repeatedly and publicly dunked on other wallet vendors - criticising their decisions and seemingly rejoicing at their misfortune or missteps - adds insult to what I believe was already a fatal injury. I don’t think there’s any way Coldcard comes back from this.

Technology securing people’s life savings should’ve been proactively red-teamed. To my knowledge there were no recognised third-party security audits, and I’ve seen multiple reports of the bug bounty programme refusing to pay out. This is inexcusable.

What about AI?

I don’t buy blaming AI. It’s like blaming an X-ray machine for discovering you have cancer.

And besides, this particular vulnerability isn’t one that’s only discoverable with AI. This isn’t a dystopian case of AI discerning passwords from the sound of keystrokes, or recovering a cryptographic key by filming the flicker of a device’s power LED. This was a build flag that didn’t do what its author thought it did. Human error, hiding in plain sight.

As an aside: I strongly believe that human connection and personality are core to Bitcoin. AI will discover and fix more vulnerabilities in our software, but there are challenges Bitcoin faces which can’t be solved in code. I doubt a machine will ever come close to a person when it comes to helping someone take their first steps toward self-custody, or to building the UX that will let Bitcoin reach its potential.

Which brings me to the small group of influencers who lean heavily on AI to write their articles and emails: we notice, and it is painfully obvious. I think your authentic voice - warts and all - would do more good in the space.

I find it strange the more I think about it. Extraordinarily complex code can be outsourced without anyone noticing. Your own plain prose can’t. That is, as our AI overlords might say, “a quiet truth worth sitting with.” lol.

Coldcard’s advocates

On the subject of influencers - a lot of the discourse on X has pointed the finger at the podcasters and community figures who promoted Coldcard’s products and held them up as a shining example of cypherpunk ideals. Coinkite’s Bitcoin-only stance was often cited, directly or indirectly, as part of what made them secure. All of that faith in the brand has proven to be misplaced.

I don’t think those who promoted Coldcard in good faith did anything wrong. People have to make a living, and sponsorships are part of the game. Anyone claiming they failed in their due diligence by not reading the source code is living in a bubble - and the same goes for the countless people who simply trusted the brand. More people should’ve verified Coldcard’s code for themselves, absolutely. But have you studied the Bitcoin source code line by line? No? Then you’re trusting it, not verifying it for yourself. And that’s fine - for 99% of people, some degree of trust is unavoidable.

I mentioned Coldcard on this website, and I feel foolish for having done so. I think Ben from BTC Sessions deserves huge respect for being so proactive, honest, and humble about the revelations and about how betrayed he feels:

Good people trusted Coldcard, and Coldcard betrayed that trust.

You can’t have it both ways

And what about the future of self-custody?

At one end of the spectrum, you have certain maxis opting for a No True Scotsman: by trusting the Coldcard’s built-in RNG, you were never really practising self-custody in the first place (or so their pseudo-philosophical pontificating goes). Only a monk sitting in a Faraday cage armed with 100 casino-grade dice and a Raspberry Pi Zero is truly a sovereign Bitcoiner™. This is nonsense, and if Bitcoin is to reach its potential among the wider population, we need the first rung on the self-custody ladder - single sig wallets - to be reliable and accessible. We need to make that happen.

At the other end, you have people proclaiming that this is the beginning of the end of self-custody; that holding your own money is impractical in the era of AI-assisted hacking, and that IBIT and the ETFs and custodial or semi-custodial solutions are the only way forward. Were that true, I believe Bitcoin would’ve failed. I also think it’s a short-sighted position that betrays enormous financial privilege - the fact that billions of people have no reliable access to a bank, a brokerage account, or a currency that can’t be manipulated is a large part of why we champion Bitcoin in the first place.

It’s worth being clear on what actually failed here. This wasn’t Bitcoin failing, nor was it the self-custody model failing. It was one vendor’s random number generator failing, in a way that other vendors have specifically designed against: a Trezor seed, for instance, is derived from multiple sources of randomness including the host computer, an internal hardware RNG, and their independently auditable secure element. The Seedsigner removes the manufacturer from your entropy entirely, allowing users to generate their own with dice rolls or even from a digital photograph using its onboard camera. The lesson isn’t that keys can’t be held; it’s that where your entropy comes from is crucial.

None of which makes self-custody risk-free. This incident is a reminder that no-one should ever be pressured into holding their own keys; the risks are real, and they should never be glossed over. And it’s telling that this one hit experienced, sophisticated users the hardest.

Looking ahead

Naturally my first thoughts are for the victims of this theft. These people did everything right. They aimed for financial sovereignty, took self-custody of their money, opted for a respected brand, and none of it mattered. People have lost their life savings because of this almighty fuck-up, and I sincerely wish there was something I could do to help them get it back.

I also have huge respect for everyone who’s helped raise the alarm, helped someone else secure their money, or simply tried to be a good person during a terrible time for Bitcoin. Particular shout outs to Rob Hamilton of Anchorwatch and Coinjoined Chris of Seedor. You make this community what it is.

Thanks for reading, and stay safe out there.