The $114 Million Randomness Gap: Coldcard's RNG Failure and the Illusion of Hardware Security

On July 14, 2026, Coinkite disclosed a flaw in Coldcard's random number generator. The cost: 1,000 BTC, or $114 million at current prices. The cause: a predictable PRNG called Yasmarang. The fix: a SHA-256 replacement and a demand for physical entropy. But the real story is not the fix. It's the five years of silence. Coldcard has long been the gold standard for Bitcoin hardware wallets. Its open-source firmware, air-gapped operation, and obsessive focus on security earned it a cult following among technical users. The device was supposed to be the last line of defense against a compromised computer. Yet, as the forensic trail now shows, the device itself was compromised at the most fundamental level: the generation of the seed phrase that controls every private key. The vulnerability was not a subtle side-channel attack or a complex exploit. It was a simple flaw in the random number generator (RNG) used as a backup for seed generation. Yasmarang, a non-cryptographic PRNG, was used to generate entropy when the primary RNG failed. Its output is predictable. An attacker who could observe the device's state could reconstruct the seed. The theft of 1,000 BTC proves that someone did exactly that. Following the trail of outliers that others ignore, I traced the seed generation path. The timeline is damning: the flawed RNG was present in firmware versions from 2021 to July 2026. That's five years of users generating seeds with a predictable source of randomness. The theft was not a single event; it was a slow leak, a silent compromise that only became visible when the stolen funds moved. Coinkite's response was swift, at least by industry standards. Within three weeks, they released firmware version 5.2.0, which replaced Yasmarang with a SHA-256-based RNG. But the more interesting fix was the forced user entropy requirement. New seed generation now demands at least 65 key presses, 50 dice throws, or 128 coin flips. This is a radical departure from the industry norm, where hardware wallets rely solely on internal RNGs. It is a tacit admission that the device's own randomness cannot be trusted. Deciphering the hidden geometry of randomness generation reveals a pattern of neglect. The RNG flaw was not discovered by Coinkite's internal testing. It was discovered after the theft, when the company launched an AI-assisted code review. Using models like Kimi, they audited the entire system, not just the RNG path. This review uncovered additional issues: transaction approval flows, USB data handling, and firmware update verification. The AI found problems that human auditors had missed for years. But the AI review is a double-edged sword. It found real issues, but it also creates a false sense of security. AI tools are not infallible. They can miss complex cryptographic logic errors. They can produce false positives. The fact that Coinkite relied on AI to find this flaw suggests that their manual audit process was inadequate. The question is: what else is still hidden? The firmware update also introduced two critical transaction safeguards. First, the device now re-verifies the transaction before signing. This prevents a compromised computer from altering the payment after the user approves it on the device. Second, the default signature mode now blocks "subsequent outputs still editable" scenarios. These are meaningful improvements, but they address symptoms, not the root cause. The root cause is the industry's over-reliance on hardware wallets as a black box. Users trust that the device generates secure randomness. They trust that the firmware is audited. They trust that the manufacturer has no backdoors. This trust is misplaced. The Coldcard incident is not an anomaly; it is a systemic failure. Every hardware wallet on the market relies on some form of internal RNG. None of them have been independently audited to the same standard as cryptographic libraries. The contrarian angle is uncomfortable: the real security of a hardware wallet lies not in the device, but in the user's ability to verify. The forced entropy requirement is a band-aid. It shifts the burden of randomness from the device to the user, but it does not eliminate the underlying risk. A user who generates 128 coin flips is still relying on the device to correctly incorporate that entropy into the seed. If the device's firmware is compromised, the physical entropy is useless. The algorithm does not lie, but it may omit. The omission here was five years of predictable randomness. The industry's response has been to praise Coinkite for its transparency and quick fix. But transparency after a $114 million theft is not a virtue; it is a necessity. The real lesson is that hardware wallets are not a panacea. They are a component of a larger security model that includes user vigilance, multi-signature setups, and regular audits. Based on my experience dissecting the FTX collateral chain, I know that trust is a liability. The same applies to hardware wallets. The Coldcard incident should push the industry toward a new standard: mandatory third-party audits of RNG implementations, public disclosure of entropy sources, and user-verifiable randomness generation. Until then, the safest approach is to assume that any hardware wallet's RNG is compromised and to add your own entropy. The next week's signal is clear: watch for other hardware wallet manufacturers to quietly update their RNGs. Ledger and Trezor will likely follow suit, but they will not advertise the change. The market will move on, but the data will remain. The 1,000 BTC that were stolen are a permanent record of a failure that was preventable. The question is not whether it will happen again. It is which device will be next.