A HARDWARE WALLET IMPLEMENTATION FAILED. SELF-CUSTODY DID NOT.
Block’s investigation has identified a serious random-number-generation flaw affecting older COLDCARD devices and has raised unresolved questions about the RNG design used in newer models, including the Mk4, Mk5 and Q.
The confirmed vulnerable path currently concerns older Mk2 and Mk3 firmware. Practical exploitation of the newer models has not been established, so we are monitoring the technical evidence closely and will update our guidance as the facts develop.
This incident reinforces an important principle: proper self-custody must never depend on a single device alone.
The Bitcoin Way’s methodology uses strong, independently generated passphrases, disciplined verification and layered security to reduce the impact of hidden implementation failures.
Anyone using a seed generated by affected firmware should treat it as compromised and migrate to a newly generated wallet immediately.
Anyone concerned about their setup or unsure whether they are practicing self-custody safely can contact The Bitcoin Way (nprofile…wmw0) for guidance, whether or not they are a client.
Never trust. Verify.
Proper self-custody remains the standard.
V4BTC
npub1ze…sxvfp
2026-07-31 05:17:44 UTC
Author Public Key
npub1zeuyhtvpk7uzzhhye6s2muz8jw46n2pkvzre933szr4ua473snyqesxvfpPublished at
2026-07-31 05:17:44 UTCEvent JSON
{
"id": "1d42fa1bea520f5ae562018ad37f284df16c6f9c6b9dd2e82c015d60e648ba9f",
"pubkey": "16784bad81b7b8215ee4cea0adf04793aba9a836608792c63010ebced7d184c8",
"created_at": 1785475064,
"kind": 1,
"tags": [
[
"p",
"f8e51fc216c8a8507347651219f07e22ef9f4299a8319fe3f7ee97a194140811",
"",
"mention"
],
[
"r",
"wss://nos.lol/"
],
[
"r",
"wss://premium.primal.net/"
],
[
"r",
"wss://nostr.oxtr.dev/"
],
[
"r",
"wss://bitcoiner.social/"
],
[
"r",
"wss://relay.snort.social/"
],
[
"r",
"wss://relay.damus.io/"
],
[
"client",
"Primal Web"
]
],
"content": "A HARDWARE WALLET IMPLEMENTATION FAILED. SELF-CUSTODY DID NOT.\n\nBlock’s investigation has identified a serious random-number-generation flaw affecting older COLDCARD devices and has raised unresolved questions about the RNG design used in newer models, including the Mk4, Mk5 and Q.\n\nThe confirmed vulnerable path currently concerns older Mk2 and Mk3 firmware. Practical exploitation of the newer models has not been established, so we are monitoring the technical evidence closely and will update our guidance as the facts develop.\n\nThis incident reinforces an important principle: proper self-custody must never depend on a single device alone.\n\nThe Bitcoin Way’s methodology uses strong, independently generated passphrases, disciplined verification and layered security to reduce the impact of hidden implementation failures.\n\nAnyone using a seed generated by affected firmware should treat it as compromised and migrate to a newly generated wallet immediately.\n\nAnyone concerned about their setup or unsure whether they are practicing self-custody safely can contact nostr:nprofile1qqs03eglcgtv32zswdrk2yse7plz9mulg2v6svvlu0m7a9apjs2qsyg3nwmw0 for guidance, whether or not they are a client.\n\nNever trust. Verify.\n\nProper self-custody remains the standard.",
"sig": "5d09dee0da71fb765dd4648453af070ffd1881b7e218b7c3a2c5b320b84ae4192420b057e541ac84d50b1c8943dec89790e669f84a3199b66ba78e6fbc215e1f"
}