Karma-X Blog
The $38 Million Random Number
Coldcard's five-year RNG failure let attackers sweep $38M from wallets this week — but seeds protected by a strong BIP39 passphrase survived. Here's why, and how TimeCapsule makes that layer practical.
What the Coldcard Entropy Failure Teaches Us About BIP39 Passphrases, Verifiable Randomness, and Why TimeCapsule Exists
On July 30, 2026, roughly 594 BTC — approximately $38 million — was swept from around 500 single-signature Bitcoin addresses in a narrow time window. Within hours, Coinkite published a security advisory confirming what security researchers had already begun to root-cause independently: for five years, affected Coldcard firmware silently generated wallet seeds from a deterministic software PRNG instead of the device’s hardware true random number generator. Seeds that should have carried at least 128 bits of entropy carried roughly 40 bits on Mk2/Mk3 devices — a keyspace an attacker can enumerate with commodity hardware.
The most important detail in this story is not the bug. It is who survived it. Users who generated their seed with verifiable dice rolls were unaffected. And users who protected their wallet with a strong BIP39 passphrase — the so-called 25th word — kept their funds even where the underlying seed was fully enumerable, because the passphrase is entropy the device never touched. The lesson is structural: never let any single device, vendor, or reputation be the sole source of your entropy. Layer your custody so that no one failure is fatal.
Coldcard has earned its reputation. It is frequently described as the gold standard of Bitcoin self-custody: air-gapped, open-source, secure-element-backed, built by people who take the threat model seriously. That reputation is precisely why this incident matters so much — because the failure occurred at the one step almost nobody verifies: the moment the device generates your seed.
ckcc.rng_bytes — which correctly reached the STM32 hardware RNG peripheral — to ngu.random.bytes, which routed through the libngu library’s broken code path.The technical failure is a chain of individually plausible mistakes that compound into catastrophe. Coinkite has not formally confirmed that the on-chain sweep and the entropy flaw are the same event, but the timing and the characteristics of the drained wallets have led researchers across the industry to identify low-entropy seed generation as the most plausible explanation.
Note what this incident is not: it is not a remote key extraction. Nobody pulled private keys off a Coldcard over USB. The keys were simply never unpredictable to begin with. Anyone who could characterize the PRNG’s behavior on the STM32 could regenerate the same seeds the devices did — and, five years later, someone apparently did, at scale. Some observers have speculated that AI-assisted code review helped outsiders spot in weeks what five years of human eyes missed in public, open-source firmware. That should concern every vendor shipping security-critical code — it is exactly the dual-use dynamic we wrote about in our Frontier AI analysis.
BIP39 supports an optional passphrase — often called the 25th word — that is combined with your mnemonic during key derivation (via PBKDF2-HMAC-SHA512) to produce the actual wallet seed. Two properties make it decisive in an incident like this one:
The arithmetic tells the story of who kept their coins this week:
Two honest caveats. First, the passphrase must itself be strong and generated off-device — a pet’s name with a year appended will fall to the same offline brute-force that recovered the seeds. Second, a passphrase is a second secret you can lose, and losing it means losing the funds. That second caveat is the reason most people never adopt a passphrase at all — and it is exactly the problem TimeCapsule was built to solve.
Whenever we demo TimeCapsule, someone asks what it’s really for. This week is the answer. The single biggest objection to strong BIP39 passphrases is operational: “If I use a 77-bit passphrase I can’t memorize, and I get hit by a bus, my family loses everything.” So people either skip the passphrase — and inherit the full risk of their device’s RNG — or they write it down next to the seed, collapsing two independent secrets back into one theft target.
TimeCapsule encrypts your BIP39 passphrase (or any critical secret) inside a cryptographic time-lock puzzle — based on the Rivest-Shamir-Wagner sequential-squaring construction — that mathematically cannot be opened before a delay you choose: 72 hours, 90 days, 180 days. Not by a thief. Not by a supercomputer. Not even by you.
Against theft: a stolen TimeCapsule USB is worthless during the delay window — you’ve rotated your funds long before it opens. Against coercion: the $5 wrench attack fails, because faster decryption is not physically possible. For inheritance: your heirs retrieve the capsule, start the solve, and recover the passphrase after the delay — no lawyer, no custodian, no trusted third party holding a copy.
A Coldcard owner following this model — seed from verified entropy, strong off-device passphrase, passphrase time-locked for heirs — would in all likelihood have watched this week’s sweep from the sidelines.
A time lock can protect a secret. It cannot repair one. If the key inside was born predictable, the strongest vault in the world is guarding something the attacker already has.
That is why we are careful about what we claim. TimeCapsule is not a panacea. It does not generate entropy, and it cannot fix a seed minted by a broken RNG — if you time-lock a weak seed phrase, you have durably preserved a compromised key. What TimeCapsule does is remove the excuse for skipping the layer that mattered this week: it makes a strong, unmemorizable, high-entropy passphrase operationally survivable for your family and your business. This incident also exposes the deeper habit TimeCapsule exists to challenge: trusting a vendor’s random number implementation — any vendor’s — as the single load-bearing secret of your custody.
This is not our first encounter with Coldcard’s security posture. On September 30, 2025, the Karma-X Security Research Team published a critical cryptographic vulnerability in Coldcard’s Delta PIN duress feature — the “panic PIN” designed to protect users under physical coercion. The implementation flaw allowed full private key recovery from just two transaction signatures produced in Delta PIN mode: a feature meant to save your funds at gunpoint could instead hand them over mathematically.
We disclosed the issue to the vendor privately, with full technical detail. To their engineering team’s credit, a fix landed quickly — we have archived the complete disclosure correspondence and the specific commit that remediated the issue. What never arrived was the public acknowledgment that Coinkite’s own website commits to providing security researchers who report issues. No credit, no mention in release notes, no CVE coordination. We published our findings on our blog and on r/coldcard, where they received very little attention at the time.
Bitcoin’s founding ethos is stronger than “trust, but verify.” It is “don’t trust — verify.” And yet seed generation is precisely where almost everyone abandons it. Users who verify every firmware signature, check every receive address on-device, and run their own node will still press “new wallet” and accept whatever twelve or twenty-four words appear on the screen, on faith that the vendor’s RNG did its job. Coldcard’s reputation is deserved — and it still shipped five years of deterministic seeds. Reputation is not entropy.
The bitter irony is that Coldcard itself ships the antidote: it supports seed generation from user-supplied dice rolls, with math you can independently verify. Users who generated their seed from 99+ dice rolls were never exposed to this bug at all. Verification was available the entire time. Trust was simply easier.
Every custody disaster produces the same retrospective sentence: “but they were the gold standard.” The Coldcard entropy failure is a five-year lesson in why that sentence should never appear in your threat model. The gold standard shipped a deterministic RNG. The panic feature we analyzed last year could leak the very keys it existed to protect. None of this makes Coldcard uniquely bad — it makes every single-vendor, single-secret custody design predictably fragile.
The architecture that survived this week was not clever. It was layered: entropy the user verified, a passphrase the device never saw, signatures no single vendor could complete, and a recovery path that needs no trusted third party. That is the design philosophy behind everything we build at Karma-X — Protection > Detection — because you cannot detect your way out of a key that was born compromised. You can only architect so that it never mattered.
Don’t trust anyone with your randomness. Not the gold standard. Not us. Verify.
From small business to enterprise, Karma-X installs simply and immediately adds peace of mind
Karma-X doesn't interfere with other software, only malware and exploits, due to its unique design.
Whether adversary nation or criminal actors, Karma-X significantly reduces exploitation risk of any organization
Update to deploy new defensive techniques to suit your organization's needs as they are offered