Dashjr fires off nine Coldcard RNG flaws, says humans got there first

Dashjr published the list Monday on X, aiming squarely at what he called the claim that only a genius AI could spot problems in the wallet's RNG. He named Coinkite co-founder Rodolfo Novak, known as nvk, as the person making that argument. Dashjr said he had already taken the issues to Coinkite in private before going public.

He didn't overclaim. Dashjr said he has no idea whether Coinkite fixed the items, and he never said each one could be weaponized or was definitely a bug. What he rejected flatly was the idea that a machine had to do the finding. His list opens with a TODO note sitting in rng_init, the routine that kicks off the Mk4's RNG, where some STM32 chips appear to need the first sample thrown out, according to Cryptopolitan.

Other items: the driver ignores the chip's seed-error and clock-error bits, and the STM32 manual calls for extra post-processing before cryptographic use. The random_buffer function catches repeated RNG output, but direct calls to rng_get don't. Dashjr said rng_get_or_fault can't be called safe until that check is proven redundant, and asked why the secure element wouldn't hold a full 256 bits of entropy if the STM32 output went deterministic. He also wanted a runtime assertion instead of a build-time switch to kill the old PRNG, warning an RNG timeout in the wrong context could crash slow devices hard enough to brick them.

Coinkite's July 30 backgrounder said the company was unaware of the bug until that day, and it theorized an outside party may have aimed AI at its open-source firmware to find the hole early. Its own AI-assisted review weeks before missed it. The root cause traces to a March 2021 firmware change that moved seed generation off the hardware random-number chip onto Yasmarang, a software tool fed by the chip's serial number and a timer. Mk2 and Mk3 seeds carried roughly 40 bits of real randomness against the 128 bits BIP-39 assumes, letting attackers rebuild weak seeds offline.

Fixes shipped as firmware 5.6.1 for Mk4 and Mk5 and 1.5.1Q for Q on August 20. Coinkite's security update credited AI-assisted review by Kimi and other frontier models and thanked outside researchers. Several changes line up with Dashjr's list: the firmware now reads the hardware RNG's seed-error state and dumps the next 12 hardware words after a recoverable error, a boot check confirms rng_get() reaches the hardware read path, and the backup generator moved to SHA-256 Hash_DRBG.

The thefts kicked off July 30, when an attacker pulled about 594 BTC, roughly $38 million, from some 500 wallets in 25 minutes. Some outflows turned out to be whitehat rescues, but total losses are pegged above $140 million. Coldcard user Amir Reza Naderi has filed a proposed class action in the Ontario Superior Court of Justice against Coinkite, Novak and co-founder Peter D. Gray, alleging they knew about the seed problem since May 2025 and stayed quiet. Coinkite has denied that.