Coldcard Flaw Exposes Gap in Hardware Wallet Testing, Kraken CSO Warns

Kraken's Chief Security Officer Nick Percoco has highlighted a flaw in Coldcard hardware wallets that exposed a gap in independent testing. According to Percoco, auditors can verify the presence of an approved random number generator in the device but cannot confirm that it is actually used by the production firmware.

The issue was discovered after Coinkite, the maker of Coldcard, published a warning about a problem in seed phrase generation on July 30. The company acknowledged that a significant portion of randomness in Coldcard came from the MicroPython pseudorandom number generator (PRNG), which is weaker than the expected hardware true random number generator (TRNG).

Coinkite's analysis revealed that the build used the Yasmarang fallback generator from MicroPython, resulting in no cryptographic entropy in ngu.random for Mk2 and Mk3 on firmware 4.x. For Mk4, Q, and Mk5, the situation differed, but ultimately limited the search space.

Percoco emphasized that simply verifying the presence of a TRNG does not guarantee security and that the industry needs an audit of the full path from the randomness source to code execution in production firmware.