Luke Dashjr Publishes Nine Coldcard RNG Concerns

Bitcoin developer Luke Dashjr on Nov. 9 publicly listed nine concerns about the random-number-generation code in Coinkite's Coldcard hardware wallet, saying he had previously reported them to the company privately.

“I'm not claiming these can all be weaponised, or that they're definitely all bugs,” Dashjr wrote in his disclosure. He said he did not know whether Coinkite had fixed them and described his review as a quick look, not a full audit.

His thread links to a July firmware revision. Coinkite's later release notes and published source show changes addressing several of the areas he raised, including chip seed-error checks and a startup test of the hardware RNG path.

The disclosure follows Coldcard's July seed-generation incident. Coinkite says attackers exploited weakened wallet seeds by regenerating private keys offline and stealing funds, without remotely accessing the devices.

Dashjr's numbered posts raised concerns about the code used after the earlier fix:

• He questioned whether initial random samples should be discarded at startup, cited missing chip seed- and clock-error checks, and said the chip manual called for post-processing for cryptographic applications.
• He said repeated-output checks applied to buffered reads but not direct calls, and argued that the lower-level error-detection routine had not been shown sufficient on its own.
• He questioned why secure-element randomness had not preserved the expected strength, urged full testing of the newly enabled RNG path, and called for an on-device check rather than relying only on build-time safeguards.
• He warned that a timeout handled in a context unable to safely process a Python exception could cause undefined behavior, potentially crashing a device or leaving it unusable.

Dashjr said he went public after hearing that NVK was claiming humans could not find the Coldcard defect. Earlier that day, Coinkite CEO Rodolfo Novak, known as NVK, wrote that it “took a new Ai model to find what humans couldn't.” Novak's post concerned discovery of the earlier seed-generation defect; Dashjr's technical thread addressed the code after the fix.

Later Firmware Added RNG Checks

Coinkite's download page lists 5.6.3 as the current standard firmware for Mk4/Mk5 and 1.5.3Q for Q. Its release history dates the addition of seed-error detection and a hardware-RNG startup self-test to version 5.6.1, released Aug. 20.

The published Mk4 source for 5.6.3 discards warm-up samples, checks seed-error flags, retries failures and tests whether calls reach the hardware random-number generator. The release notes also say both secure elements are now sampled directly for each new master seed, rather than contributing only through boot-time RNG seeding.

The current source still places its repeated-output check in the buffered-read routine rather than in every direct call. Its comments say clock-error flags are deliberately ignored, citing chip documentation that those errors do not invalidate generated numbers.

For users affected by the July incident, Coinkite's standing guidance remains that updating firmware does not repair an existing weakened seed. Those users should follow its migration guidance unless the advisory's independent-dice exception applies.