You Can't Audit Entropy After the Fact: Operator Lessons from the Coldcard Seed Failure · 808bitsYou Can't Audit Entropy After the Fact: Operator Lessons from the Coldcard Seed Failure<br>2026-08-02 · 8 min<br>Over two days starting July 30, 2026, coins left Coldcard-generated wallets in three coordinated waves. By August 2, forensic work by Galaxy Research put the confirmed total near 1,367 BTC ($88.6M) across more than 4,500 addresses . The victims had done what the industry told them to do. They bought a well-regarded, security-focused hardware signer, generated the seed on the device, and kept it offline. Many had not touched those wallets in years. The attacker never touched a single device.<br>The cause, per Coinkite&rsquo;s advisory and technical backgrounder, was a firmware regression that shipped in March 2021 and survived five years of releases and reviews: seed generation silently stopped using the hardware random number generator.<br>One preprocessor semantic<br>The mechanics are almost offensively small. Coldcard&rsquo;s build defined MICROPY_HW_ENABLE_RNG as 0 because Coinkite supplies its own hardware-RNG wrapper. Downstream, a guard checked #ifndef MICROPY_HW_ENABLE_RNG: whether the macro exists, not whether it is enabled. Defined-as-zero passed the check, and the build quietly linked MicroPython&rsquo;s software fallback: Yasmarang , a toy PRNG intended for chips with no hardware RNG at all, seeded from the chip&rsquo;s unique ID and boot-time state and never fed fresh entropy again.<br>The result, by Coinkite&rsquo;s own estimate: seeds on Mk2/Mk3 (firmware 4.0.1 through 4.1.9) carried roughly 40 bits of effective entropy. Mk4, Mk5, and Q devices got an accidental partial rescue in 2022 (a 32-bit reseed from the secure element), bringing them to roughly 72 bits . The design target was 128. A 40-bit keyspace is a weekend project on commodity hardware, and the sweeps observed so far are consistent with exactly that: Mk3-era seeds. A 72-bit search is far harder, and no public evidence yet shows one cracked in the wild, but it sits uncomfortably within reach of a well-funded adversary with patience, which is why Coinkite tells Mk4, Mk5, and Q users to migrate too rather than wait to find out.<br>Two details deserve attention from anyone who runs key-management processes for a living:<br>The correct code was present the whole time. The hardware-TRNG implementation existed in every affected binary, reviewed and intact. It was simply never called from the seed-generation path. Coinkite&rsquo;s post-mortem language is precise: reviews &ldquo;did not verify end-to-end symbol resolution and call reachability.&rdquo; The check confirmed the code existed; nobody confirmed it was reachable. That is the same failure shape as an unverified backup: presence mistaken for function.<br>The introducing change was mundane. Per an independent analysis of the commit history, the regression arrived while integrating a crypto library, as a workaround for a duplicate-symbol compile error. Nothing about it looked like a security decision. The most dangerous changes to a security-critical system rarely announce themselves as one.<br>Why nobody could see it in the output<br>Here is the uncomfortable part: there was no artifact anyone could have inspected afterward to catch this.<br>Keys derived from a broken RNG look exactly like keys derived from a perfect one. A seed with 40 bits of real entropy still expands into well-distributed, unique-looking addresses; the output of even a weak PRNG passes casual statistical inspection, and no test suite run against outputs can distinguish &ldquo;unpredictable&rdquo; from &ldquo;deterministic but unexamined.&rdquo; Entropy is not a property of the bytes. It is a property of the process that produced the bytes , and once generation is over, that process has left no trace unless you deliberately recorded one.<br>This is worth stating as a general law, because it separates key generation from almost everything else in custody operations. A backup can be verified after the fact. A recovery procedure can be drilled after the fact. Randomness is the one input you can only witness at the moment of creation. Whatever assurance you want about it has to be built into the ceremony and evidenced at generation time . Afterward is too late, structurally and permanently.<br>Who survived, and why<br>The postmortem sorts affected users into groups, and the sorting is instructive because every surviving group made its decisive move at generation time.<br>Dice-roll users survived. Coldcard has always offered seed generation from 50+ user-supplied dice rolls. On affected firmware, those rolls were hashed together with the (weak) device entropy, which means user entropy carried the seed: 50 private rolls contribute about 128 bits on their own, regardless of what the device added. The people the community sometimes teased for paranoia-theater dice ceremonies are the people whose funds never moved. Independent entropy at the ceremony is not...