How NOT to trust your Hardware Wallet

On July 30, 2026, the COLDCARDs started falling. In four waves, and without a single exploit transaction on chain, attackers drained more than 5,200 addresses and took 1,816 BTC — around 116 million dollars — according to TRM Labs’ count. No device was hacked, remotely accessed or taken over: Coinkite’s advisory says it in those words.

Three months later it was Ledger’s turn, for a reason that looks nothing like it. The devices were genuine, the firmware was the official one and the chip was intact: what was inside was an implant hidden under the screen, with a cellular module, transmitting the seed words while the user read them.

Two attacks, two lessons. One broke the number; the other broke the box. Twelve slides and a clandestine manual to understand both halves of the same sentence: your hardware wallet does not custody your key, it custodies the quality of your entropy and of the chain that brought it to your house. And of all that, only part of it is something you can verify with your own hands.

Two hits, two lessons

COLDCARD: the number. Firmware 4.0.1, from March 2021, shipped with a compile-time guard that checked whether a certain hardware-generator macro existed, not whether it was switched on. When it wasn’t, seed generation fell silently onto Yasmarang, the pseudo-random generator that ships with MicroPython, seeded with data that is not secret: the chip’s serial number and the timer registers. Effective strength landed at about 40 bits on Mk2 and Mk3 —some analyses put it between 22 and 32— and about 72 on Mk4, Q and Mk5, through partial mixing with the secure element. The design called for 128.

At 40 bits there is nothing to hack: you enumerate the possible seeds, derive their addresses and watch the blockchain. When a balance shows up, you drain it. That is all that happened across those four waves, without touching a single victim, without sprinkling a satoshi of dust along the way.

Two details that matter when it’s your turn: updating the firmware does not fix a seed that already exists —you have to create a new one with your own entropy and move the funds—, and anyone with a BIP39 passphrase or enough dice of their own was not on the list. Coinkite shipped emergency firmware (5.6.0+) that no longer allows generating a seed without user entropy.

Ledger: the box. October 2026, another layer, another method. Attackers bought genuine Nano X units, opened them, glued an implant into the padding gap under the screen —an STM32 microcontroller, an LTE module with eSIM and an antenna— and put them back into circulation, mostly through resellers in Southeast Asia. Cases also turned up via Amazon and in Europe.

The implant touches neither the secure element nor the operating system: it reads the twenty-four words straight off the screen while the device displays them during initial setup, and sends them over the cellular network. The Genuine Check passed without trouble, because the original chip was still there and it was genuine. Ledger confirmed there was no compromise of its manufacturing, firmware or internal systems: it is a physical attack, after the factory, against distribution. Estimated losses: between 90 and 100 million dollars across hundreds of wallets.

Neither case needed a cryptographic vulnerability. The first asked for a silent five-year-old bug in a compile-time guard; the second, a complicit courier. And in both, the same uncomfortable certainty: the air gap covers neither.

The mirage of the perfect vault

Bitcoin demands that you custody your own money, and the hardware wallet solved the problem with an impeccable metaphor: a physical vault, isolated from the internet, air-gapped, with the private key inside and its own screen to sign on. The metaphor sells itself because it is tactile: you plug the device in, press two buttons, and walk away calm.

The question the safe never answers is the one on the sign: who built the lock, and who keeps the copy of the master key? In the COLDCARD case the vendor was serious, the firmware was open, the users were sophisticated, and the error happened anyway. The device kept showing its little screen, kept asking for the PIN, kept being an undecipherable brick. And all the while it was handing out 40-bit keys with the same solemnity as 128-bit ones.

You cannot see entropy. That is the whole trap. Everything else about the device can be inspected: the enclosure, the price, the community, the repos. The one thing that decides whether your money is yours or anyone’s is settled in a few milliseconds of noise, inside a chip, and it never shows up on any screen.

The device’s only real job

It helps to break the ritual into three steps, because only one of the three carries real risk:

• Step A — zero risk: your computer assembles the transaction. You pick the recipient, the amount, the fee. If your computer is infected it can assemble a different transaction: that gets fixed by looking at the device’s screen before signing.
• Step B — critical risk: the device signs with the private key inside it, never touching the internet. This is where the only irreversible thing happens.
• Step C — zero risk: the signed transaction goes out into the world. A signature cannot leak: it is public by definition, and once it is out there is nothing left to steal.

All of the device’s value is concentrated in Step B — and so is all of its attack surface. You don’t need to break the chip: it is enough for the firmware to decide that the key may leave — which is exactly what Ledger’s Recover feature proved in 2023, when it became clear that the sentence “the key never leaves the chip” is a design decision and not a law of physics.

That gives us the first rule, and it is counterintuitive: the device’s job is not to store the key. It is to sign with it. Everything it does besides that is surface, and everything that adds “convenience” is surface you are handing to a third party.

The trap of blind trust

A two-row table dismantles the sales pitch:

The promise	The reality
”It’s open source.”	The software is. The silicon isn’t: there is no way to verify what the chip actually does (STM32, ESP32, or the secure element with its NDA’d datasheet).
”It ships sealed from the factory.”	Supply-chain tampering —the October Ledger implant is exactly this—, compromised couriers, fake devices and factory backdoors.

Open source is a real virtue and also the easiest part to obtain: reproducible builds prove that the binary matches the code, not that the chip running that binary does what the code says. And on the supply-chain side there is plenty of history. In December 2023, the @ledgerhq/connect-kit package published to npm shipped with a drainer inside it — a former employee’s npm account, versions 1.1.5 to 1.1.7, roughly two hours live, some 600,000 dollars drained across dApps and users. Nobody had to break cryptography. Somebody had to publish a module.

And there is a cheaper risk than all of the above: the 2020 Ledger leak, with some 272,000 home addresses and a million emails, fed years of phishing, phone calls, extortion and home invasions against people who had done the right thing and had merely bought a vault. That is the reason for the first rule of the manifesto: saying in public that you own a hardware wallet is announcing that your house contains something worth taking.

The Clandestine Manifesto

Three rules, and they should be read as hygiene rather than heroics:

1. Do not say you own a HW. Never disclose that you have one. Not in the forum thread, not in the group, not in a background photo. Discretion is the only mitigation that depends on no vendor.
2. Do not buy a HW. Or rather: do not buy it blindly. Buying it so that it can guess for you is delegating the only part that matters to a stranger.
3. Do not trust a HW. Use it as what it is: a boring calculator that signs and calls nobody.

And a footnote that stopped being theoretical in October: if you buy one anyway, buy it straight from the manufacturer and open it up before trusting it with a seed. The Ledger attack would not exist without the reseller.

The hidden enemy: entropy

Entropy here means exactly one thing: how many different numbers the process that invented your seed could have produced inside the device. A hundred bits of entropy means 2¹⁰⁰ possibilities; forty means a trillion, which sounds enormous and is walked end to end in an afternoon. The safety of your funds does not depend on the length of the phrase you wrote down, it depends on how much ignorance about which of those numbers was yours remained in the system.

The problem is that a microchip is by nature the opposite of chance: it is a calculator that repeats the same computation and always returns the same result. To manufacture chance you have to go look for it outside, in a physical phenomenon that cannot repeat itself. Hardware random generators (TRNGs) try it with thermal noise, oscillator jitter and other analog sources, then mix everything through a cryptographic function. When that chain breaks — a deterministic fallback, a 32-bit timestamp seed, a macro turned off — it is not cryptography that fails: what fails is the point where the physical world was supposed to enter the chip and didn’t.

Two cases with the same signature show it better than any theory. In 2023, the finding published as Milk Sad (CVE-2023-39910) showed that bx seed, from Libbitcoin Explorer 3.x, used the Mersenne Twister generator initialized with 32 bits of system time: four billion possibilities — nothing — and the affected wallets were swept. And the 2026 COLDCARD case, with a misspelled compile-time guard and a 32-bit reseed on the fallback path. Different products, different years, same sin: when the good source is missing, someone wrote a plan B, and plan B was also the key.

Quantum physics vs. the real world

Theory says true randomness can only come from an unpredictable physical event. It is a road people have already walked: Alex Waltz built a quantum random number generator for Bitcoin seeds using radioactive decay — an americium-241 sample taken from a smoke detector — a Geiger tube and a Raspberry Pi. It works, it is beautiful, and it is proof that physical entropy is real and verifiable.

Now the practice: you don’t keep plutonium in the pantry. Your hardware wallet has a small, cheap analog generator with a two-page datasheet, and the vendor neither shows you the numbers that came out nor lets you compare them against anything. There is no quantum theory in there: there is trust, which is the opposite.

The conclusion is not “build yourself a nuclear generator”. It is far more modest and far more useful: assume your device’s internal generator is weak, and stop asking it to be the only one. The solution is not technological, it is analogical: it is solved with dice.

Step 1: become the chaos

Buy casino dice — the real ones, with sharp edges, not the ones from a board game — and do what the device does, but outside it: roll the dice dozens of times and write down the exact results. Then have your device or your computer use that sequence as a source of entropy and mix it with its own, instead of letting them decide alone.

The numbers, because here they matter. Nothing in the digital world uses more than 256 bits, and the 128 bits a 12-word phrase requires are already unreachable: each roll of a six-sided die contributes log₂(6) ≈ 2.58 bits, so 50 rolls are 129 bits — more than the entire vault uses — and 200 rolls are around 517 bits. Coinkite’s advisory is explicit: seeds created between March 2021 and July 2026 are at risk if they were generated without at least 50 independent, private dice rolls and a strong, unique BIP39 passphrase.

A bit of technical honesty, because the devil is in the detail: a die can be loaded and your way of throwing it can be predictable, which is why no serious protocol uses raw dice but rather dice mixed through a hash function. What matters is not that the dice are perfect. What matters is that nobody else holds a copy of the result. The factory generator can be compromised by whoever made it; your rolls cannot. That is everything you are buying.

Step 2: the universal translator (BIP39)

Humans cannot write down 256 bits without making a mistake, so Bitcoin standardized a translator: BIP39. The entropy sequence is split into 11-bit chunks, each chunk indexes a word in a 2048-word dictionary (2¹¹), and a checksum is appended — 4 bits for a 12-word phrase, 8 for a 24-word one — so the device can detect a bad copy. That is where the seed phrase you write on paper comes from: twenty-four words that are, literally, one number written in a two-thousand-word language.

Two misunderstandings worth money. First: the seed phrase is not the key. It is the input to a derivation function (PBKDF2-HMAC-SHA512) that produces the master seed; from there — and only from there — all your keys come. Second: that function accepts an extra ingredient, the passphrase or “25th word”, which is not in your backup. If your entropy is bad, the passphrase is the only thing that saves you; if your entropy is good, it is the only thing that saves you from someone finding the paper. It is the layer almost nobody uses, and the one that turned the COLDCARD disaster into a scare for part of those affected and a total loss for the rest.

And there is an implementation trap worth naming, because it is exactly this article’s point: dice do not produce powers of two. Sixty faces do not fit into 2048 exactly, so the program converting rolls into words has to discard the values that fall outside the range — if instead it takes them modulo, it introduces a bias, and that bias is a clue. Your entropy is only as strong as the arithmetic of the program that translates it. One more reason to use a known, audited tool rather than the first one you find.

Step 3: total isolation (Paranoid Mode)

There is no mystery to the procedure, but it is done whole or it is useless:

• General-purpose hardware: an old PC you use for nothing else. Not your everyday machine, not the work one, not the one with the Downloads folder.
• The tool on a USB stick: download Ian Coleman’s BIP39 converter — a single HTML file, it runs without a server — and verify it. That copy is used offline, not opened from a browser with internet.
• Cut the connection: turn off wifi, unplug the cable, and only then open the tool on the old PC, with your list of rolls on paper.
• Write the words down in absolute secrecy, by hand, on paper — or better, stamped into a steel plate, which neither soaks nor burns. And afterwards: power the machine up only to shut it down and wipe it, not to “check the balance”.

Step 3 is the one almost everyone skips, and the one that turns the other two into theatre. If you generate the seed with your dice on your everyday machine, with wifi on and a browser full of extensions, you improved nothing: you handed malware exactly what the vendor never had.

The custody spectrum

Put the two extremes side by side and the choice becomes clear:

Beginner level. The device generates the seed. You trust its firmware, its hardware generator, its secure element and the supply chain that brought it to your house. When something in that chain fails — the COLDCARD bug, the intercepted mail, the firmware that one day decides to export — you lose everything and find out on Twitter. It is not stupidity: it is the level almost everyone runs at, including plenty of people who think they are experts.

Ninja level. You create the seed physically. The device is a dumb calculator that signs: you don’t ask it to invent anything, only to multiply what you already invented. You still trust the firmware that mixes your entropy with its own — that residue exists and you should know it does — but you no longer trust the origin of your key to a chip you cannot see.

That is the spectrum: there is no zero-trust point, there is a minimal and visible trust point. Between “I trust everything a stranger did for me” and “I trust that this program mixes what I did, and I can review the code that does it”, the distance is your entire security.

The Zen of self-custody

Verify everything you can. Be ruthless about the generation of your keys, which is the only moment in the process where you can still do something. Then accept the rest: no tool will give you zero trust, and whoever promises you an unbreakable vault is selling you a plastic box.

Real security is not bought packaged: it is built by taking responsibility for your own entropy. It is the same epistemic move we have been telling in this series, always from the same side: you don’t need to have it all to know it is fine. PeerDAS does not download the whole block: it samples a few cells and knows. Ğ1’s web of trust does not demand anyone’s complete truth: it asks for five signatures that expire and get renewed. And here, you don’t need a perfect random number generator: you need the number you invented to be one nobody else invented.

Two and a half months after the disaster, the vendor itself still recommends what it recommended before: 50 dice rolls and a strong passphrase. Dice are a coffee-table joke, and they are the only component of the system that neither the vendor, nor the courier, nor the firmware, nor an attacker holding your complete history can predict.

The device gives you the signature. The randomness you have to bring yourself.