Coinkite Urges Some COLDCARD Users to Replace Seeds After Entropy Flaw

Coinkite advises affected users to generate new seeds

Coinkite has warned some COLDCARD hardware-wallet users to replace seeds generated under specified affected firmware versions, update to corrected firmware, and carefully move funds to addresses controlled by a newly created wallet.

In its security advisory, the company said seeds generated by affected firmware are at risk. Its recommended remediation is not merely moving an existing seed to another wallet application or hardware device. Instead, users should generate an entirely new seed after installing fixed firmware, verify the backup, and then migrate bitcoin to the new wallet.

The distinction is significant because a seed is the source from which a wallet's private keys are derived. If the seed-generation process was predictable, importing the same seed elsewhere does not change the keys or remove the risk.

Entropy issue affected hardware random-number contribution

Coinkite's technical backgrounder attributes the issue to the hardware random-number generator failing to contribute randomness as intended in affected firmware. The company characterized the problem as an entropy failure in seed generation, rather than a compromise affecting every COLDCARD device or every seed ever used with one.

Block Engineering's Bitcoin security team independently examined the vulnerable code path in its report, “Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmware”. Block said the weakness involved a deterministic MicroPython random-number-generator fallback and a 32-bit reseed condition. Its researchers also reported active exploitation of the flaw.

For owners of potentially affected wallets, the immediate concern is that an attacker able to reconstruct or predict the original entropy could derive the same private keys and spend bitcoin associated with them. Reusing that seed in a different wallet therefore leaves the underlying exposure unchanged.

Sources do not identify Kimi as the discoverer

Online discussion has linked the discovery to Kimi, an AI model, but the cited source material does not establish that attribution.

Coinkite said it assumes an AI-assisted code review may have helped uncover the issue, without naming a particular model or provider. Bitcoin Optech's newsletter coverage likewise reported that developers reproduced the attack with help from frontier AI models, but did not identify Kimi.

The available evidence supports a narrower conclusion: AI tools may have assisted researchers in reviewing code or reproducing the attack. It does not show that Kimi specifically discovered the vulnerability, participated in exploitation, or was connected to reported thefts.

Recommended response

Users should review Coinkite's advisory to determine whether their firmware version and seed-generation history fall within the affected scope. For seeds covered by the warning, Coinkite's documented approach is to install fixed firmware, generate and safely back up a new seed, and transfer funds to the new wallet.

Users should not enter recovery words into websites or share them with purported support personnel. Changing wallet software or hardware without replacing the seed is also insufficient, because the security concern lies with the original seed material and the private keys derived from it.