COLDCARD’s random numbers weren’t.

A build guard checked whether the hardware RNG macro existed, not whether it was enabled. From March 2021, affected devices could generate wallet seeds from predictable inputs. From 30 Jul to 2 Aug 2026, tracked sweeps took 1,433.13 BTC from 5,477 addresses; destinations received 1,432.48 BTC after miner fees.

BTC swept

1,432.48BTC

2,896 confirmed transactions

Swept addresses

5,477

distinct addresses spent by those transactions

UTXOs swept

7,346

outputs spent by those transactions

BTCAddressesUTXOs

WaveAll W960183 W960185 W960188 W960345 W960352 W960359 W960395 W960518 W960668 W960737

The plates

The sweep

7,346 UTXOs · 2,896 sweeps · 1,432.48 BTC

Flow chart

5,477 swept addresses · 613 destinations

Routes

1,432.46 BTC still at tracked destinations

Address ledger

bc1qxz7s2u…gqgf2451.07
bc1qhrgyed…w57uvw49.79
bc1qe85jr4…a2ahlr29.89

5,477 addresses · 7,346 UTXOs

Evidence

25 public sources across 10 waves

The bug

#ifndef HAS_RNG
  #error "no hardware RNG"
#endif

#define HAS_RNG 0 satisfies it

128 bits intended · 73.3 at best · 0 at worst

How it shipped

4 commits · 2 direct pushes · 0 reviews

Timeline

five years, first commit to first sweep