Good thread to have, and fair question given how foundational Coldcard has been in this space.

For anyone wondering about physical collectibles here: the key generation process I use for f*D pieces doesn't involve Coldcard or any commercial hardware wallet at all. Keys are generated on a dedicated offline system using standard, well-vetted cryptographic randomness sources, not anything tied to a specific hardware wallet's onboard RNG. From what's being reported, this issue is specific to certain firmware versions of that particular device substituting predictable data for true randomness, which is a different failure mode entirely from a general-purpose offline setup.

I'll leave the deeper technical breakdown to people more qualified to speak on Coldcard's internals specifically. But wanted to speak up for the collector/physical Bitcoin side of things, since I know a few of you hold pieces from me and others in this space, and it's a fair thing to ask about.

Appreciate you raising it openly, RS. Hope things ease up for you outside the forum too.

 Coldkey was pre planned and malicious in nature.

 ColdCard was dumb as shit for them not checking their own software randomness or in intentionally bypassing it.

  What Went WrongFirmware Bug: A code error in Coldcard firmware (introduced around March 2021) bypassed the device's hardware True Random Number Generator (TRNG).
  Weak Randomness: Devices fell back to a predictable software pseudo-random number generator (Yasmarang), drastically reducing the entropy (randomness) of generated 12 or 24-word seed phrases.
  Exploitation: Attackers used the predictable output space to brute-force private keys and steal millions in Bitcoin from single-signature wallets

  

  Read here>>  https://www.coindesk.com/tech/2026/07/31/major-bitcoin-wallet-flaw-drains-594-btc-in-25-minute-sweep

   We have a saying in crytpto....VERIFY DON'T TRUST
   And damn did we fail. I wish I had the ability to have the knowledge to test any wallet cause I would have.
 

This should be a little bit more specific on how it happened.



how to upload images online free

thank you all for your input, I have been educating myself on your info and been combing X .com for more, have a great day guys =)

The more I read the more it looks like it was an inside job. The bug was introduced by a member of their team using an alias and was reported to them several times over the years by different people. I hate that the term ‘retirement attack’ has been added to my vocabulary and it makes me uncomfortable that this is a possibility in Bitcoin collectibles that seemingly has no backwards compatible solution.

Some of their old posts are downright suspicious. Here they seem to be letting people know how to avoid the retirement attack that was coming years later…



After describing the retirement attack and having the exact scenario play out, even Grok has suspicions.



I don’t know what can be done about this, but it hurts the community for sure. If this had been Casascius coins or my Minted Seats I would be a very sad guy. Has me rethinking the whole cold storage collectibles thing.

Nothing like the Coinkite CTO asking his own alias to use his own code in the Coldcard software.



If this wasn’t done intentionally, there sure is a lot of strange things that happened with seemingly no explanation. The more I read about this though, the more it seems clear what happened. The surprising part to me is just how long they waited. They must have been watching Coldcard balances grow and biding their time.