Coldcard's RNG bug: 1,432 BTC swept, zero reviews, five years of silence

Coldcard, a Bitcoin hardware wallet known for its security-first ethos, has been caught with its pants down. A bug in its random number generator (RNG) allowed attackers to derive private keys and sweep funds from wallets. The numbers are stark: 7,346 UTXOs, 2,896 sweeps, and 1,432.48 BTC — over $100 million at current prices — moved to attacker-controlled addresses.

The root cause is a classic: a #ifndef HAS_RNG guard that should have enforced the presence of a hardware RNG. Instead, #define HAS_RNG 0 satisfies the check, meaning the device could run with no RNG at all. The intended security was 128 bits of entropy; the implementation delivered 73.3 bits at best, and 0 at worst. That's not a rounding error — that's a catastrophic failure.

How did this ship? Four commits, two direct pushes, and zero code reviews. No one looked at the code before it went out the door. The timeline shows the first commit in May 2018, with loss reports starting in May 2021, and public posts in July 2021. Yet the first on-chain sweeps didn't appear until July 2026 — five years after the first loss reports. That's a five-year gap between knowing something was wrong and doing something about it.

The site, coldcard.rip, is a forensic breakdown by someone who clearly did their homework. It tracks 5,477 swept addresses and 613 destinations, with 1,432.46 BTC still sitting at tracked destinations. The evidence section lists 25 public sources across 10 waves, and the timeline is a damning record of inaction.

For engineers, this is a textbook case of why code review matters, why entropy is not a checkbox, and why you should never trust a hardware wallet that doesn't have a hardware RNG — and even then, verify it's actually used.