Coldcard’s 5-year flaw reveals hardware wallet testing gap: Kraken’s security chief

The five-year bug escaped detection because auditors verified that the intended random number generator existed, but not that it was being called.

Update (Aug. 4 at 2:50 am UTC): Added information shared by Ledger about its own device certifications.

Coldcard’s five-year seed-generation flaw has exposed a broader weakness in how hardware wallets are independently tested, according to Kraken chief security officer Nick Percoco. 

In an X post on Sunday, Percoco said the incident should be a “wake-up call” for hardware-wallet makers, calling for independent testing to verify that the approved source of randomness is the one actually used by production firmware. 

Read more