Coldcard hardware wallet
Shares rank 3 of 4 cryptocurrency wallets by recommenders
Recommended as a cold bitcoin wallet with documented dice-based seed generation, but a 2026 RNG flaw caused large bitcoin thefts and critics distrust its security.
Recommended as a cold bitcoin wallet with documented dice-based seed generation, but a 2026 RNG flaw caused large bitcoin thefts and critics distrust its security.
25 people gave an opinion
- recommend it
- 5
- criticize it
- 20
- approval share
- 20%
Recommended in 3 of 13 months
- November 2025: not recommended
- December 2025: not recommended
- January 2026: not recommended
- February 2026: not recommended
- March 2026: recommended
- April 2026: not recommended
- May 2026: not recommended
- June 2026: not recommended
- July 2026: not recommended
- August 2026: recommended
- September 2026: not recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 5 people recommend itNeeds 10 or more, not met.
- 0.2 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 3 of 13 monthsNeeds 4 or more, not met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Documented dice-based seed generation
“Coldcard's own documentation had a section on generating secure seeds with dice and why that's more secure.”
Comment from 5 Aug 2026 in “When random.bytes() runs but doesn't work” Recommended as a cold wallet
“Cold wallet was definitely recommended late 2025”
Comment from 2 Aug 2026 in “The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M” Advised to diversify entropy sources
“You'd probably want to use diversity for this”
Comment from 13 Oct 2026 in “Ledger confirms spy chip implant behind wallet crypto thefts”
What people warn about
Each mark is one comment
Weak 32-bit RNG fallback
“the Coldcard hardware wallet had an issue where it'd fallback to a 32-bit only RNG that could be cracked”
Comment from 11 Oct 2026 in “Ledger confirms spy chip implant behind wallet crypto thefts” “the RNG in the coldcard mk2 was badly/maliciously implemented and is completely insecure”
Comment from 13 Oct 2026 in “Ledger confirms spy chip implant behind wallet crypto thefts” “accidentally switched their RNG from the hardware RNG to a predictable PRNG”
Comment from 30 Oct 2026 in “Binance-hacker-1029 – $5.6B stolen from Binance” - Comment from 13 Oct 2026 in “Ledger confirms spy chip implant behind wallet crypto thefts”
Users lost bitcoin to the bug
“bug in the RNG logic during seed generation, so you can lose funds easily without any action from the user”
Comment from 2 Aug 2026 in “Galaxy Research Coldcard hack update: 1,158.81 BTC stolen from 2,673 addresses” “lost 10 years worth of bitcoin he'd saved and mined from this Coldcard issue”
Comment from 31 Jul 2026 in “Predictable RNG Fallback and 32-Bit Reseed in Coldcard Firmware” “Coldcard Bitcoin seed generators were compromised a little over a month ago”
Comment from 8 Sep 2026 in “I've factored the RSA keys of a Certificate Authority from the 90s” Poor engineering and repeated flaws
“there was no actual assessment of whether the team or the product was made with the care needed”
Comment from 2 Aug 2026 in “Galaxy Research Coldcard hack update: 1,158.81 BTC stolen from 2,673 addresses” “This isn't the first time they've had a similar vulnerability that allowed for stealing coins”
Comment from 5 Aug 2026 in “Coldcard's $38M (so far) exploit shakes faith in self-custody” “Clearly seems like a corporate culture issue. A very low bar seems standard practice.”
Comment from 2 Aug 2026 in “The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M” - Comment from 2 Aug 2026 in “The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M”
Open-source status drew criticism
“the btc community members who chose to go with one of the few hardware wallets that wasn't open source were not doing due their diligence”
Comment from 2 Aug 2026 in “The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M” “the bug in RNG was actually introduced inadvertently in an effort by Coinkite to move the firmware away from an open source license”
Comment from 2 Aug 2026 in “Galaxy Research Coldcard hack update: 1,158.81 BTC stolen from 2,673 addresses” “it was open source in a way that from the discussion here may have made vulnerabilities easier to spot for an attacker”
Comment from 2 Aug 2026 in “The Coldcard Disaster Gets Worse: The Hack May Have Reached $88.6M”
Other cryptocurrency wallets people recommend
The three most recommended other cryptocurrency wallets, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Ledger hardware wallet | 11 | 47 | 19% | 4 | — | — |
| Trezor Safe 5 | 6 | 4 | 60% | 2 | — | — |
| Coldcard hardware walletThis page | 5 | 20 | 20% | 3 | — | — |
| Cake Wallet | 5 | 2 | 71% | 4 | — | — |
What people said
31 of the 33 comments that mention it, newest first. Each links to the original comment.
“recent hacks of bitcoin hardware wallets, like Ledger and ColdCard”
“accidentally switched their RNG from the hardware RNG to a predictable PRNG”
“insufficient entropy is the real problem”
“supply chain attacks cough cough”
“You'd probably want to use diversity for this”
“the RNG in the coldcard mk2 was badly/maliciously implemented and is completely insecure”
“Coldcard hardware wallets fell back on a RNG with only 32 bits of entropy”
“the Coldcard hardware wallet had an issue where it'd fallback to a 32-bit only RNG that could be cracked”
“If those Coldcard devices had used this code as one source of entropy, and this source of entropy was the only entropy still working, they never would had been compromised.”
“Coldcard Bitcoin seed generators were compromised a little over a month ago”
“Coldcard's own documentation had a section on generating secure seeds with dice and why that's more secure.”
“This isn't the first time they've had a similar vulnerability that allowed for stealing coins”
“there was no actual assessment of whether the team or the product was made with the care needed”
“At least my dice don’t boot up with insufficient entropy”
“the bug in RNG was actually introduced inadvertently in an effort by Coinkite to move the firmware away from an open source license”
“bug in the RNG logic during seed generation, so you can lose funds easily without any action from the user”
“Cold wallet was definitely recommended late 2025”
“the failsafe is defective”
“A very low bar seems standard practice.”
“There is no $249 device that I would trust with even 1 BTC.”
“A few people did call out Coinkite for poor engineering at the time”
“it was open source in a way that from the discussion here may have made vulnerabilities easier to spot for an attacker”
“a company willing to show the world how they were fiddling with low-level random generation stuff”
“the btc community members who chose to go with one of the few hardware wallets that wasn't open source were not doing due their diligence”
“Clearly seems like a corporate culture issue. A very low bar seems standard practice.”
“there are weak engineering practices applied”
“The fundamental cause is a mixup between a value test and a definedness test.”
“this stupidest thing coinkite did was their dogshit design”
“would silently fall back to an insecure RNG”
“lost 10 years worth of bitcoin he'd saved and mined from this Coldcard issue”
“72 bits is a nasty surprise”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.