A bug in Coldcard hardware wallets went unnoticed for five years because security auditors checked that the intended random number generator existed — but never verified that the code actually called it. The flaw, which affects the device's cryptographic randomness, was discovered only recently by an independent researcher. Coldcard has since released a firmware update to fix the issue.
How the bug slipped through
The wallet's firmware included a random number generator designed to produce secure cryptographic keys. Auditors confirmed the generator was present in the codebase. What they missed: the wallet's key-generation routine never invoked that generator. Instead, it used a different, weaker source of randomness that could potentially be predicted or manipulated.
This oversight is a classic case of checking for the right component without checking that it's actually used. The bug existed since the wallet's initial release, meaning every key generated over those five years may have relied on substandard randomness.
What the bug means for users
Weak randomness can make private keys easier to guess or brute-force. In theory, an attacker who knows the flaw could target Coldcard wallets to steal funds. The company says no funds have been lost as a result of this bug, but it's urging all users to update their firmware immediately. After the update, users should generate new seed phrases and move funds to fresh wallets.
The incident highlights a blind spot in hardware wallet security audits. Auditors often focus on whether a security feature exists, not whether the firmware actually uses it. That gap can leave users exposed for years.
Coldcard has patched the bug in the latest firmware release. The company hasn't said whether it will change its audit process going forward. For the broader crypto hardware industry, the question remains: how many other wallets have similar audit gaps? No one knows — and that's the problem.
