Coldcard RNG flaws were findable by humans, Luke Dashjr says in nine-point thread

Bitcoin Core developer Luke Dashjr raised nine concerns about Coldcard’s random-number code on Monday, saying he had first raised them with Coinkite privately. He posted the list to counter what he called the claim that only a “genius AI” could find flaws in the wallet’s RNG. Nine RNG concerns go public after private reports to Coinkite “It’s been long enough, and I hear nvk is going around pretending humans couldn’t find the Coldcard defect,” Dashjr wrote in a thread on X.

Rodolfo Novak (Nvk) is a co-founder of Coinkite. Luke Dashjr’s opening post in the thread, published on X on November 9, 2026. Dashjr said he had no idea if Coinkite fixed the items after he told the company.

He didn’t say that every item could be weaponized or that everything was definitely a bug. “But the claim that only a ‘genius AI’ could find issues with the RNG is a blatant lie,” wrote Dashjr. First item flagged a TODO note in rng_init, the routine that starts the Mk4’s RNG.

Some STM32 chips seem to require the first sample to be thrown away, he wrote. The driver also disregards the chip’s seed-error and clock-error bits, Dashjr says. And the STM32 manual calls for additional post-processing for cryptographic uses, he said.

The random_buffer function detects repeated RNG output, but direct calls to rng_get do not. Dashjr said the rng_get_or_fault can’t be considered safe until the random_buffer check can be proven redundant. He also asked if the STM32 output became deterministic, then why didn’t the secure element randomness hold entropy at the full 256 bits.

Dashjr said that the replacement code was basically a novel RNG that necessitated full testing. The patch disables the old PRNG only at build time, and he sought a runtime assertion instead. An RNG timeout in the wrong context could lead to undefined behavior, possibly a crash that risks bricking slow devices, he wrote.

Coinkite firmware 5. 6. 1 already checks the flagged seed-error state Coinkite’s technical backgrounder of July 30, 2026 said the firm was “unaware of the bug until today.

” Cryptopolitan reported that the company theorized an external party may have used AI on its open-source firmware to detect the vulnerability ahead of time. Coinkite added that it had not been detected by its own AI-assisted review, conducted weeks earlier. The flaw was the result of a firmware change made in March 2021 that moved seed generation off the hardware random-number chip.

Instead, the seeds came from Yasmarang, a software tool fed by the chip’s serial number and a timer. The Mk2 and Mk3 seeds had around 40 bits of real randomness, which is far less than the 128 bits BIP-39 assumes, and attackers were able to reconstruct the weak seeds offline. Mk4 and Mk5 received firmware 5.

6. 1, and Q received 1. 5.

1Q on August 20th. Coinkite’s security update cited “AI-assisted review by Kimi and other frontier models” and thanked outside researchers for reporting issues. Some of the changes are on Dashjr’s list.

Firmware now checks the seed-error state of the hardware RNG and discards the next 12 hardware words after a recoverable error. A boot check ensures rng_get hits the hardware read path. Changed backup generator to SHA-256 Hash_DRBG.

Thefts started July 30, when an attacker snatched about 594 BTC, ~$38 million, from some 500 wallets in 25 minutes. Some outflows were whitehat rescues, but cumulative losses are estimated at over $140 million. Coldcard customer Amir Reza Naderi has mounted a proposed class action in the Ontario Superior Court of Justice against Coinkite, Novak, and co-founder Peter D.

Gray. He says they knew about the seed-generation problem from May 2025 and didn’t warn users, something that Coinkite has denied. The smartest crypto minds already read our newsletter.

Want in? Join them.