Hardware Wallets Face Scrutiny Over Lack of End-to-End Verification

Coldcard's five-year seed-generation issue has sparked a debate over how hardware wallets are independently verified, according to Kraken's chief security officer Nick Percoco. The incident highlights the need for end-to-end checks that confirm the randomness source reviewed in testing is the same one actually executed by production firmware.

The problem began when Coldcard altered its seed-generation process in March 2021 as it integrated a new cryptographic library. This update unintentionally routed wallet creation to a weaker MicroPython generator already present in the codebase, rather than using the intended true random number generator (TRNG) code.

CoinKite has halted all device shipments and destroyed remaining units containing the affected firmware. The company advises users with affected devices not to dispose of them immediately, as this might become essential if funds are recovered.

Kraken's chief security officer argues that hardware wallet certification should include verification that the approved entropy path is what production firmware uses in practice. He points out that existing standards used in the broader security and payments industries, such as NIST SP 800-90B and BSI AIS-31, make it more difficult for systems to 'pass review' without proving that the approved randomness pathway is actually used for critical operations.