A critical vulnerability lurking in Coldcard hardware wallets for five years exposed a fundamental gap in how security auditors test hardware wallet code. The bug went undetected because auditors confirmed the random number generator existed in the codebase but never verified it was actually being invoked during key generation.
Kraken's security chief flagged the flaw as a watershed moment for the industry. The vulnerability meant Coldcard devices could generate private keys with insufficient entropy, potentially making them susceptible to brute-force attacks. An attacker with access to a compromised device might recover the seed phrase through computational means rather than brute force.
The discovery highlights how hardware wallet audits often rely on code review rather than dynamic testing and behavioral validation. Auditors can miss execution flaws when they focus solely on whether security components exist in the code. The flaw persisted across multiple Coldcard firmware versions and multiple security reviews without being caught.
This incident follows a pattern in hardware wallet security. Previous failures have stemmed from firmware update mechanisms, supply chain vulnerabilities, and implementation bugs rather than cryptographic weaknesses. Users store billions in value on these devices, yet testing standards remain inconsistent.
Coldcard addressed the flaw in a firmware update, but the episode raises uncomfortable questions about third-party hardware wallet audits. Many auditors lack specialized expertise in embedded systems testing. They may not understand how firmware executes differently across hardware revisions or how compiler optimizations can alter code paths.
The vulnerability underscores why hardware wallet users should practice key hygiene. Generating keys offline on airgapped devices, verifying seed phrases across multiple signing attempts, and testing recovery from seed on separate hardware provides defense in depth against single-point failures.
For the broader market, this incident pressures wallet manufacturers to adopt more rigorous testing. Red-teaming exercises, fuzzing firmware, and validating key generation through statistical analysis