This is not an oopsy. This is disqualifying.
A software engineer with an MSc in Computer Science and 25+ years in the industry just explained why Coinkite’s Coldcard bug should end the company.
Read This And Tell Us Coinkite Deserves Another Chance
Coldcard’s seed generation silently fell back to a non-cryptographic “random” number generator for 5 years. Not because crypto is hard, but because Coinkite violated the most basic rule of secure system design: fail closed, never open.
When a security-critical path can’t be verified, the system refuses to run and throws an error. It does not quietly substitute something weaker and carry on.
This code should have refused to produce a seed. Instead it produced a predictable one and continued silently. ☠️
A company that lets its most critical code path go unverified for half a decade cannot be trusted with your keys.
Throw away your Coldcards. Never buy one again.
Fail Closed, Never Open
Every competent security engineer knows this rule. It is taught in the first month of every secure design course:
When something critical cannot be verified, STOP. Throw an error. Refuse to run. Do NOT quietly substitute a weaker alternative and carry on as if nothing happened.
Coldcard’s seed generator did exactly the wrong thing. When the crypto RNG could not be verified, it silently swapped in a non-cryptographic generator and kept producing seeds.
For FIVE YEARS.
What This Actually Means
It means every seed generated on affected firmware came from a source that was never meant to protect money. The engineers either:
- Didn’t know the fallback existed (gross negligence in a security product), or
- Knew and shipped it anyway (even worse), or
- Wrote it so the failure path was invisible to review (systemic failure)
Any one of those is disqualifying for a company whose entire product promise is “your keys are safe with us.”
This Was Not A Random Bug
This was not a bad commit. Not a bad merge. Not bad luck.
This was a design decision — an explicit or implicit choice to let a security-critical path fail open. For five years. Across multiple product lines. The kind of decision that gets engineers fired and companies sued.
And remember the timeline: the code was rewritten in 2021 specifically to remove GPL dependencies. The rewrite is when the fallback got introduced. Licensing paranoia created a five-year silent vulnerability in the most security-critical path of a security product.
The Verdict
Coinkite cannot be trusted with your keys. Not anymore. Maybe not ever again.
A company that lets its most critical code path go unverified for half a decade has no excuse. No apology covers it. No firmware update fixes the trust that was broken.
If you own a Coldcard: migrate your funds, generate fresh seeds on verified hardware, and never look back.
Throw away your Coldcards. Never buy one again.
Source: Expert engineer’s analysis on X
"THROW AWAY YOUR COLDCARDS" — 25-YEAR ENGINEER CALLS THE BUG DISQUALIFYING
