Bought a hardware wallet for peace of mind, only to find out its seed phrase was “pseudorandom.” Coinkite’s Coldcard has been exposed: a March 2021 firmware update secretly disabled the chip’s true random number generator, leaving seed phrases with only 40 bits of entropy, when the BIP-39 standard requires 128 bits. It was like printing the front-door passcode in the product manual. On July 30, attackers drained 594 $BTC (about $38 million) in 25 minutes, hitting more than 500 wallets. Total losses exceeded $140 million, with over 5,200 victims. On September 11, Ontario’s Superior Court officially accepted a class-action lawsuit. The plaintiffs say the founding team knew as early as May 2025; the company denies this, saying it only found out that same day and has since released a patch. The patch is out, but not a single stolen coin has been returned. What are you really buying with a cold wallet: true security or peace of mind? Vote in the comments: A. Keep using hardware wallets after the fix; B. Trust is gone—move everything back to an exchange.

$ETH $SOL
#Coldcard #HardwareWallet