A critical vulnerability in Coldcard hardware wallets prompts Bitcoin users to adopt physical dice for secure seed generation.
Bitcoin holders are reevaluating self-custody security after a critical flaw in Coldcard hardware wallets exposed vulnerabilities in seed phrase generation. The issue, linked to thefts beginning July 30, stems from a firmware change in version 4.0.1 that replaced a hardware-based random number generator with a less secure software alternative.
The flaw affected devices running firmware released in March 2021, where MicroPython’s Yasmarang PRNG was used instead of the STM32’s hardware random number generator. Analysts criticized the fallback as inadequate for cryptographic security, though Coldcard’s manufacturer disputed claims it was intentionally insecure.
In response, users are turning to physical dice to generate entropy for seed phrases, bypassing reliance on potentially compromised hardware. The incident underscores broader concerns about trust in hardware wallet security assumptions.