Where Does Your Seed Actually Come From?

In July 2026 the Coldcard hack drained roughly 1,800 bitcoin from hardware wallets that had done nothing wrong except trust a single source of randomness. Here is why that class of failure looks different on a two-card wallet.

Published 26 August 2026  ·  Cryptnox SA, Geneva

Every self-custody wallet you have ever set up began with a coin flip. Not literally — but the first thing that happens, before the twelve words, before the addresses, before anything you can see, is that the device reaches for a source of randomness and asks it for a number nobody will ever guess.

Everything downstream is arithmetic. Your seed phrase, your master key, every address you will ever receive to, every signature you will ever make — all of it is derived, deterministically, from that one number. The mathematics that follows is public and well understood. The security of the whole arrangement rests on one question: was that first number genuinely unguessable?

Almost nobody checks. You cannot check. A wallet with a broken random number generator behaves exactly like a wallet with a perfect one — same words, same addresses, same signatures, same green checkmarks. The difference only surfaces when somebody else guesses your number first.

On 30 July 2026, somebody did.

The Coldcard hack: five years of a silent build flag

The incident is worth understanding precisely, because the interesting part is not that a bug existed. It is how ordinary the bug was.

Coldcard, a well-regarded and genuinely security-focused bitcoin hardware wallet, ships with a real hardware random number generator inside its microcontroller. Its firmware was written to use it. In March 2021, a firmware release changed which function the seed generator called, and a configuration macro was tested for existence rather than for being switched on. In the production build, that macro was set to zero. The check passed anyway.

The result: seed generation quietly stopped drawing from the hardware generator and started drawing from a software pseudo-random fallback that shipped with the embedded Python runtime. No error. No warning. No visible difference. For five years, devices generated seeds that looked completely normal and were drawn from a space small enough to search.

Exploitation, when it came, took 25 minutes. Between roughly 01:31 and 01:56 UTC on 30 July 2026, a first sweep took about 594 BTC — some 38 million dollars — out of around 500 single-signature wallets. Further waves ran for another week. Blockchain analysts at Galaxy Research put the confirmed total at roughly 1,800 BTC, about 115 million dollars at the time of the thefts, across some 8,900 addresses.

The vendor shipped emergency firmware for every affected model overnight. But firmware cannot repair a seed that has already been generated. Every affected user had to create a new wallet and move their coins — assuming they heard about it in time.

A patch fixes the next seed. It cannot fix the one you already own.

The shape of the failure

Strip away the specifics and this is what is left:

• One source. The seed came from a single random number generator on a single device. There was nothing else in the recipe.
• A silent fallback path. The device contained a weaker software generator that the build could accidentally select. The strong path and the weak path were interchangeable from the calling code's point of view.
• No way to notice. Nothing the user could see, test, or compare would have revealed the difference — for five years.

That combination is what turns a small mistake into a total loss. Not the mistake itself — the fact that a single mistake was sufficient.

What two cards change

The cards in question are the Cryptnox Crypto Hardware Wallet — Dual-Card Set: two credit-card-sized NFC smart cards, made in Switzerland, each built on a Common Criteria EAL6+ certified secure element. You tap a card against your phone and the Cryptnox app talks to it over NFC. Private keys are generated inside the secure element and never leave it, which is the constraint the rest of this section follows from.

Cryptnox cards can generate a wallet in a mode we call dual generation, and it exists because of a different original problem: how do you get a backup of a key that is never allowed to leave the secure element it was born in? You cannot write it down, because nothing can read it out.

The answer is to have two cards agree on a secret that neither of them ever transmits. Each card generates its own private random number and keeps it. Each publishes only the corresponding public value. The two public values are exchanged — through your phone, which acts purely as a courier — and each card independently combines its own private number with the other card's public value.

This is Diffie–Hellman key agreement, the same mechanism that protects the connection to your bank. Both cards arrive at the identical shared secret. The seed is a hash of it. Two cards, one wallet, and the secret was never in the air, never in the phone, never on a screen.

shared secret → SHA-256 → your wallet seed

That last point is the one worth sitting with, because it is a mathematical property, not a policy or a promise. Combining the two private numbers is a reversible operation in the underlying arithmetic — which means that if either of them is genuinely unpredictable, the result is genuinely unpredictable. A completely broken generator in one card is not enough. It is not even close to enough.

Compare that with the failure above, where one flawed generator on one device was the entire attack.

Three structural differences

And the seed is never assembled anywhere else

Worth stating plainly, because it is where a lot of wallets are quietly weakest: at no point does a Cryptnox seed exist on your phone, your laptop, or a screen. The cards exchange public values only, and each card authenticates the other's value using a secret installed at the factory and shared only within a card pair. Your phone cannot substitute its own key into the exchange, and cannot compute the result of it. It genuinely is a courier.

What we changed anyway

Reading an incident like this and concluding that your own design is fine is the wrong reflex. Two sources are better than one; three are better than two, and the marginal cost is close to zero.

So the current card firmware adds an independent entropy contribution from your phone, mixed into the on-card randomness for both single-card and dual-card wallet creation. Mixed, not substituted — the phone's contribution is combined with the card's own, so a phone that contributes nothing useful, or a phone that is actively malicious, cannot weaken the result. It can only add to it.

For a dual-card wallet that means three independent sources — two secure elements and your handset — where the industry's worst recent failure came from having one.

The question is never whether a generator can fail. It is how many have to fail at once.

If you hold a hardware wallet — any hardware wallet

• Check whether your device was affected. The Coldcard advisory covers Mk2 through Q. If you generated a seed on affected firmware, updating is not sufficient — the seed itself must be replaced and the coins moved.
• Ask any vendor where the first number comes from. How many independent sources? Is there a weaker path the code could take? Can you, the owner, detect it if something went wrong? These are answerable questions, and a vendor who cannot answer them clearly has told you something.
• Prefer designs where one mistake is not enough. That principle is worth more over a decade than any individual audit.

Randomness is the one part of self-custody that you cannot verify by looking. It deserves more than one source.

Frequently asked questions

---

Sources

• Block Engineering — Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmware, technical analysis of the build-flag failure
• Coldcard entropy incident — timeline of the 30 July 2026 sweep and per-model remediation
• Galaxy Research loss tally as reported, 24 August 2026 — 1,789 BTC across 8,865 addresses
• Cryptnox — Dual Generation Mode

Reported figures on the Coldcard incident moved substantially in the weeks after disclosure; the totals above are those confirmed as of 24 August 2026. Cryptnox cards ship with a certified secure element and no software fallback random number generator. Cryptnox cards are made in Switzerland.