Back

The Coldcard Incident: How Did This Happen?

Blog posts

Before You Read:


Ledger is not affected by the recently published Coldcard Mk3 advisory.

Ledger devices use a certified True Random Number Generator (TRNG) built directly into our Secure Element chip, generating full 256 bits of entropy for every 24-word Secret Recovery Phrase. Please refer to this article for more information.

Coinkite has published a security advisory regarding certain Coldcard Mk3 firmware versions – you can read their notice here.

The Coldcard Incident: The Foundation of Randomness

On July 31st, 2026, Coldcard reported that a firmware bug had weakened how some devices generated seed phrases leading to significant user losses. Back in late 2022, the Ledger Donjon discovered a similar vulnerability in the Trust Wallet browser extension.

The bug made every wallet created by the extension recoverable from its public address. In practice, an attacker could derive the private keys and steal the funds without any user interaction. The search space was small enough to brute force.

The Donjon reported the issue responsibly. Trust Wallet spent roughly five months patching the software and giving users time to migrate their funds before the vulnerability was disclosed publicly. That process simply prevented one of the largest wallet compromises the ecosystem has ever seen.

Cryptography is hard. Implementing it securely is harder. And the part almost nobody thinks about, generating high quality randomness, is where the whole thing lives or dies. This week’s Coldcard incident made that visible in the most expensive way possible.


Coldcard: How the Landscape Is Different Today

What broke. Every private key you own derives from one number: the seed. If that number is predictable, everything derived from it is too. Coldcard’s firmware was supposed to draw that seed from a dedicated hardware RNG. It didn’t. A guard checked whether a config macro was defined, not whether it was enabled, so the build silently fell back to a software generator seeded from the chip’s serial number and timer, values an attacker can reconstruct. 

Older devices were effectively deterministic; current ones were capped near 32 bits, about four billion possibilities. A seed space advertised as 128 bits collapsed to something you can enumerate. Researchers estimate more than 1,000 BTC drained from roughly 1,200 wallets, from a flaw sitting in public code since March 2021. The device never had to be touched.

A bad RNG is silent. The output still looks random and passes casual inspection. You discover the problem when someone else does, on-chain, at 21:56 on a Thursday. That is why randomness cannot be a software convenience with a fallback path. It has to be engineered, measured, and certified as a first-class security function.

How we do it at Ledger. We build on certified Secure Elements specifically to access the best cryptographic primitives, including a True hardware RNG. The TRNG is physics, not a formula: it leverages chaotic physical phenomena on silicon to produce genuine entropy, so there is no seed to guess. The Secure Element embeds hardware detectors that watch for malfunctions and manipulation, environmental sensors, active shielding, glitch and voltage detection. Extreme temperature, for instance, can degrade a noise source, so the hardware is built to catch that rather than quietly ship weak entropy. And raw entropy is never used directly: this low-throughput source is fed into cryptographic post-processing inside Ledger OS. Physics for the entropy, cryptography to condition it.

The certifications, and what they mean. Claims are cheap. Certifications are third parties trying to break your claims. Our TRNG is evaluated under AIS-31 and certified PTG.2. AIS-31 is the German BSI methodology, used inside the Common Criteria scheme, that defines how to evaluate a true physical RNG, including a stochastic model of the noise source, not just tests on the output. The Secure Element carries Common Criteria certification at EAL5+ / EAL6+. And Ledger devices are certified under CSPN, ANSSI’s first-level scheme, with random number generation quality explicitly in scope. The exact failure that hit Coldcard, “generating a biased or deterministic random number,” is written down as Threat #1 in our published security targets, and the TRNG is the security function that answers it.

On closed source, honestly. This part of Ledger OS is closed source. Access to this Secure Element technology comes with a hard vendor requirement that the low-level implementation stays closed. We love open source, but between the highest level of certified security and open source philosophy for this specific layer, we chose security, and I still think that was the right call. 

Closed source does not mean unaudited: our code goes through regular evaluation by multiple independent vendors and earns certification on a recurring basis. Security shall not rely on obscurity, that principle stands. 

But it is also true that closed source raises the cost of vulnerability research for an attacker. Both are true at once. A flaw sitting in public code for five years until an adversary reportedly used AI to find it is a reminder that “open” and “reviewed” are not the same word.

That AI angle is not a footnote. Internally we make heavy use of LLMs to hunt for vulnerabilities in our own products, and it is genuinely effective (Read the excellent blogpost on the matter). 

The adversary is already doing this at machine speed. So do we, before they do. More on our approach soon.

None of this makes us immune. It makes us measurable, monitored, and certified against exactly the class of failure that just played out. Cryptographic guarantees beat social trust, always. A seed you cannot predict beats a promise that it was random.

With modern LLMs, rediscovering vulnerabilities, understanding patches, and building exploitation pipelines has become dramatically easier. The window between “patched” and “weaponized” is shrinking.

Responsible disclosure is still essential, but vulnerability management has to evolve. Faster patching, shorter disclosure timelines, and migration strategies that assume capable AI-assisted attackers are now part of the security model, not optional improvements.

Charles Guillemet, Ledger CTO

You might also like