The $114 Million RNG Failure: Coldcard's Firmware Crisis and the Broken Trust Model of Hardware Wallets

$114 million in Bitcoin. Stolen. Not from an exchange. Not from a DeFi protocol. From hardware wallets — the devices that the self-custody movement has spent years telling everyone are the only safe way to hold Bitcoin. The attack vector? A backup random number generator running Yasmarang, a pseudo-random number generator with known predictability issues that has no business being anywhere near key generation. Coinkite, the Canadian company behind Coldcard, has now released a firmware update that forces users to manually generate entropy through dice throws, coin flips, and keystroke timing. That's not a feature. That's an admission that the device's internal entropy sources can't be trusted. I've been tracking hardware wallet security since my early days auditing smart contracts during the 2020 DeFi summer. This is one of the most significant failures I've seen in the self-custody space — not because the bug was sophisticated, but because it was so basic. A non-cryptographic PRNG used for seed generation. For five years. And nobody caught it until $114 million walked out the door. Security was too good to be true, so we didn't question it. That's the lesson here. Coldcard has built its reputation on being the paranoid's choice in the hardware wallet market. Open-source firmware. Air-gapped operation. No touchscreen to leak data. It's the wallet that Bitcoin maximalists recommend when they want to sound serious about security. The company's entire value proposition is that hardware wallets are the safest way to hold Bitcoin — safer than exchanges, safer than hot wallets, safer than anything else. And then this happens. The vulnerability window spans from 2021 to July 2026. That's roughly five years of devices potentially generating seeds with insufficient randomness. The backup RNG — the one that kicks in when the primary entropy source fails — was running Yasmarang. For those who haven't spent time auditing PRNGs: Yasmarang is not cryptographically secure. Its output is predictable. If an attacker can predict the seed, they can derive the private keys. No physical access required. No malware needed. Just math. The timeline matters here. Coinkite disclosed the vulnerability and released a fix within three weeks. That's fast — faster than most companies move on security issues. But it also raises questions. If the fix was that straightforward, why did the vulnerability exist for five years? Why wasn't the RNG audited earlier? And most importantly, what else is in the firmware that hasn't been found yet? The company has published a security status page and is working with law enforcement on the thefts. But the damage is done. Users who created seeds during the affected period need to assume their keys are compromised and migrate to new wallets. That's not a simple process. It involves generating new seeds, transferring funds, and hoping you don't make a mistake in the process. Let me break down what Coinkite actually did in this firmware update, because the fix is as revealing as the bug itself. First, the RNG replacement. The backup RNG now uses SHA-256 instead of Yasmarang. That's the right call — SHA-256 is a cryptographic hash function with well-understood properties and a long track record of secure use. But here's the thing: this should never have been Yasmarang in the first place. Using a non-cryptographic PRNG for key generation is a fundamental error, not a subtle one. This is the kind of mistake that gets flagged in a basic security review. The fact that it survived for five years suggests that either the code review process was inadequate, or the RNG path was never properly examined. Yasmarang is a particularly bad choice for cryptographic applications. It's a lightweight PRNG designed for speed, not security. Its internal state is small, and its output has measurable statistical biases. For a hardware wallet — a device whose entire purpose is to generate and protect cryptographic keys — using Yasmarang as a fallback RNG is like building a bank vault with a cardboard door. It's not a sophisticated attack that exploited this. It's a known weakness that should have been caught in any competent security review. Second, the forced entropy input. New seed generation now requires at least 65 keystrokes with unpredictable timing, 50 dice throws, or 128 coin flips. This is Coinkite saying: "We don't trust our own hardware RNG anymore, so you need to provide physical entropy." That's a remarkable admission. It's also a UX nightmare. Try explaining to a non-technical user that they need to flip a coin 128 times to create a wallet. This is the "zero trust" philosophy taken to its logical extreme — but it also signals that the device's internal entropy sources are not considered reliable. From my experience auditing hardware and firmware, this is a significant philosophical shift. Most hardware wallets rely on internal RNGs — typically a combination of hardware noise sources and cryptographic mixing. The assumption is that the hardware RNG is secure. Coldcard is now saying that assumption doesn't hold, at least not for their devices. That's a big deal. The seed button was a lever, not a purchase — it was supposed to be the foundation of your security, not a point of failure. Third, the AI-assisted code review. Coinkite used Kimi and other frontier AI models to audit the entire codebase, not just the RNG path. This found additional issues: transaction approval logic, USB data handling, and firmware update verification. I've been in this industry long enough to be skeptical of AI review claims. AI tools can catch patterns, but they can also produce false positives and miss context-dependent vulnerabilities. The fact that Coinkite is touting this as a security measure tells me they're either genuinely ahead of the curve or trying to signal competence after a major failure. Probably both. The AI review finding issues in transaction approval logic is particularly concerning. That's the core function of a hardware wallet — approving transactions. If that logic was flawed, it means the device could potentially sign transactions that the user didn't intend to sign. The fix includes re-verifying the transaction right before signing, which prevents a compromised host computer from swapping the payload after user approval. This is a defense against the "what you see is not what you sign" problem — a known attack vector in hardware wallets. Fourth, the signature mode restrictions. The firmware now blocks signature modes where "subsequent outputs remain editable." This closes a malleability window that could be exploited by a malicious host. It's a good fix, but it's also a fix for a problem that shouldn't exist in a well-designed hardware wallet. Let me put this in perspective. The $114 million theft is not a small number. It's a significant portion of the total value held in Coldcard devices. And it's not clear how many users are affected. The vulnerability window spans five years, which means potentially thousands of devices. Each affected user needs to: verify whether their seed was generated during the affected period, generate a new seed using the new entropy requirements, transfer their funds to the new wallet, verify the transfer was successful, and securely destroy the old seed. That's a high-risk process. Users who aren't technically sophisticated could make mistakes — sending funds to wrong addresses, losing seed phrases, or failing to properly verify the new firmware. The fix itself creates new attack surface. And here's the uncomfortable part: the users who are most affected are likely the ones who were most careful about security. The paranoid Bitcoiners who bought Coldcard specifically because they didn't trust exchanges or hot wallets. They did everything right, and they still got hit. The market implications are worth examining. Coldcard occupies a specific niche in the hardware wallet market — the technical, security-focused Bitcoin user. Ledger and Trezor have broader appeal, but Coldcard has always been the choice for people who take self-custody seriously. This event could push some of those users toward competitors, but it's not clear that Ledger or Trezor are any safer. They all rely on internal RNGs. They all have closed or partially closed firmware. The difference is that Coldcard got caught. Here's the angle nobody's talking about: this event doesn't just damage Coldcard — it damages the entire hardware wallet trust model. The industry narrative has been "hardware wallets are safe, exchanges are risky." That narrative just took a direct hit. If a device's backup RNG can silently produce predictable keys for five years, what else is lurking in the firmware? The answer is: we don't know. And that's the problem. The AI review is interesting, but it's not a substitute for independent third-party audits. Coinkite hasn't mentioned any external audit of the new firmware. That's a gap. AI models are trained on existing code patterns — they're good at finding known vulnerability classes, but they're not great at novel attack vectors. The Yasmarang issue was a known vulnerability class. What about the unknown unknowns? And here's the uncomfortable truth: the $114 million theft is likely just the beginning. Law enforcement is investigating, but tracing stolen Bitcoin is hard. Some of that money is probably gone forever. The victims — the users who trusted their hardware wallets — are the ones eating the loss. Not Coinkite. Not the auditors. The users. The forced entropy requirement is a band-aid, not a cure. It addresses the symptom — insufficient randomness — but it doesn't address the root cause: a hardware wallet manufacturer that didn't properly audit its own RNG for five years. The real fix is a fundamental rethinking of how hardware wallets generate and protect keys. That means mandatory third-party audits. That means independent verification of every security-critical component. That means treating hardware wallets as what they are: computers with a specific job, not magic boxes. Volatility is just fear wearing a disguise — and right now, the fear in the hardware wallet market is real. The question is whether it will translate into meaningful change or just another round of "we fixed it, move on." The competitive landscape is shifting. Ledger and Trezor could benefit from Coldcard's misfortune, but they should be careful about celebrating. The same class of vulnerability could exist in their products. The entire industry needs to take a hard look at its RNG implementations and security review processes. This isn't a Coldcard problem. It's a hardware wallet problem. For the broader Bitcoin ecosystem, this event is a reminder that self-custody is not a magic solution. It's a responsibility. Users need to understand the risks of their chosen tools, and manufacturers need to be held to a higher standard. The Bitcoin Red Team and similar security initiatives are more important than ever — they represent the community's effort to identify and address vulnerabilities before they're exploited. The Coldcard incident is a wake-up call for the entire self-custody ecosystem. Hardware wallets are not magic. They're computers with a specific job, and they can have bugs just like any other computer. The question isn't whether Coldcard will recover — it's whether the industry will learn the right lessons. For users: check your firmware version. If you created a seed between 2021 and July 2026, assume it's compromised and migrate. For the industry: third-party audits need to become mandatory, not optional. For Coinkite: the forced entropy requirement is a good start, but it's a band-aid on a deeper problem. The real test is what happens next. Will Coldcard submit to independent audits? Will other hardware wallet manufacturers follow suit with their own RNG reviews? Or will this become another "we fixed it, move on" moment? The market is watching. And so am I. The next six months will tell us whether the hardware wallet industry takes this seriously. If we see a wave of independent audits and transparent security disclosures, that's a good sign. If we see silence and marketing spin, that's a bad sign. The users who lost $114 million deserve better. The users who are still holding Coldcard devices deserve better. And the industry that has built its reputation on security needs to prove that it actually deserves that reputation. I've been through enough market cycles to know that security incidents like this tend to be forgotten quickly. The crypto community has a short memory. But the lessons from this event should stick. RNGs matter. Audits matter. Transparency matters. And the next time someone tells you that hardware wallets are the safest way to hold Bitcoin, ask them one question: has the firmware been independently audited? If the answer is no, you know what to do.