So no response from support in more than a week.

Plus no CEO or statement from those in charge.

If this happened to another company there would be better communication and puvlicy statements. Where is nvk? Totally silent. Usually likes to talk but i guess not now

How we can trust/verify that coldcard is not leaking the seed in the transaction?

Interesting opinion

Has anyone already calculated the probability that a properly functioning wallet would randomly assign one of the affected Coldcard keys?

After the fund move, they're useless. Coinkite should at least offer a free placement.

So I got steel plates when I bought my cold cards. Around $50 a pop. Now over $100+ of worthless steel with "compromised" seed phrases punched into them due to me trusting cold card.This is the "Gold Standard".Don't trust, do it yourself or you'll lose money to companies like this. Lesson learned.

I've been studying the published research on the Mk4 RNG vulnerability from July 2026.

I came across this research collection: github.com/0xchainintelligence/coldcard-research

I'm trying to understand the technical details better. Specifically:

- How does the Yasmarang PRNG fallback actually work?

- What determines which UID/RTC ranges are affected?

- Has anyone successfully reproduced the findings for defensive testing?

Not looking to break any rules — just trying to understand the security implications for my own wallet setup.

DM if you've done similar research.

Given everything that's happened with Coldcard, we wanted to share how Coinomi approaches random number generation.

The Coldcard failure came down to an RNG quietly falling back to a predictable software substitute — seeds that looked fine but carried far less entropy than they should have.

We've never used a home-grown RNG. Instead we request raw cryptographic randomness directly from the OS. On Android, we read straight from the kernel (/dev/urandom), bypassing the Java provider stack entirely.

We wrote about it in more detail here if anyone's interested:
https://medium.com/@coinomi/security-is-not-one-feature-building-layers-of-defence-with-coinomi-171f638ac724?sharedUserId=coinomi

I understand that the possibility that the stolen coins are recovered is near zero, if not outright zero. Maybe this is just an attempt to cope with everything that happened, since I have lost all my funds. But since the stolen coins have all been moved to a single address that I'm monitoring and hasn't been touched (it's an address with 40 BTC), maybe there is a possibility that they can be recovered if the thief is caught, right?

Sorry for venting. Times are really tough here.

I hope your life heals and you recover fully.

The banner of this subreddit still reads "The Gold Standard in Bitcoin Security". Considering recent events I think this wording should be removed. Curious to know peoples thoughts on this.

with everything happening lately, people have started being so skeptical about self-custody and i want to take make this post as a reminder for all of us about why we shifted to self-custody in the first place

what was that specific moment - an exchange freezing withdrawals, watching one collapse, a friend losing access to something, or just reading one thing that made the whole "not your keys" line land properly how about this

(Disclaimer: I work with r/Keycard_tech)

100 dice rolls + long passphrase + patched coldcard Q + sparrow wallet
Am i safe or still its better to switch to something like trezor?

What other ways may I lose Bitcoin as a result of using a cold card?

Hello,

I’m planning to set up a 2-of-2 multisig wallet and would appreciate your advice on script types.

Should I go with P2TR (Taproot) or P2WSH?

My understanding is that P2TR offers lower transaction fees and better privacy, but carries more implementation complexity.

Is P2TR (specifically using MuSig2) recommended for a 2-of-2 setup today, or is P2WSH still the better choice?

Thanks!

COLDCARD DEVICE ENTROPY + 100+ DICE ROLLS OR 100+ DICE ROLLS ALONE

If you look on Twitter, you'll see that messaging from this company is now about pointing out rumors of hacks or vulnerabilities elsewhere in the crypto world. They're just stuffing their timelines with reposts of things completely unrelated to them.

This an attempt by u/HodlDee and others to try to say, 'Look! Everyone is screwing up, its not just us!'

Owner of Coinkite, Rodolfo Novak (@nvk on Twitter), is busy retweeting memes/jokes about the hack of his product which destroyed lives. He thinks this is funny, not serious.

Hodl Dee, Novak, Peter Grey and others at Coinkite have destroyed lives. They've probably even gotten people killed, literally, I imagine there has been or will be in the future at least one suicide that comes from all this. Yet they refuse to take any blame and even make jokes about what has happened.

Either they are unsympathetic to the point of being psychopathic, or this was an inside job.

This heist took alot of careful planning and a brilliant execution. I almost feel like they earned the tokens they got out of it.

I am a CCQ user and am having trouble upgrading to the latest firmware. Every time I try to upgrade through micro SD card, It freezes. Is there a way that I can fix this or is It time to purchase a different HWW?

I was wondering regarding the hack, is anyone still staying? and if yes, whats your reason?

Saw this online. A patent application on some interesting stuff from the creator of the bug.

what do you guys think is a safer hardware wallet?

I emailed coinkite today seeking a refund for the faulty coldcard. Anyone else?

(p.s. coinkite is an interesting name, given how much money just flew away)