Hardware Wallets Rethought After $38M Losses Due to RNG Flaw

A recent flaw in Coldcard's random number generation (RNG) system has led to $38 million in losses for some users of XRP Ledger wallets. The issue, which went unnoticed for about five years after a 2021 code change, highlights the importance of secure seed generation in hardware wallets.

Xaman founder Wietse Wind argued that labeling a wallet as 'hardware' does not automatically make it secure. He pointed out that the method used to create private keys is just as important as the device itself. According to Wind, many users misunderstand what hardware wallets actually protect and think they are entirely safe, but in reality, their security ultimately depends on how the wallet seed is generated.

Xaman uses built-in mobile security features for random number generation, obtaining 128 bits of randomness directly from the phone's operating system security features. Wind said Xaman does not use custom cryptography or create its own random number systems and instead relies on the same built-in security sources used by many banking apps and password managers.

Wind emphasized that the main question is not whether software or hardware wallets are safer, but rather how wallet randomness is generated and whether the process has been independently tested. He added that Xaman's system was audited years ago and continues to be regularly tested.