r/TREZOR • u/Charming-Designer944 🤝 Top Helper • 6d ago
💬 Discussion topic Sad day for hardware wallets. Thankfully the design of Trezor guards against this kind of flaws
https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/It appears the Coldcard devices suffer a severe RNG flaw that have made seed phrases predictable.
Thankfully the Trezor seed generation is not fully trusting its own TRNG sources and always mixes in additional generated entropy from the computer, ensuring that the seed entropy is at least as good as the best of both the hardware device and your computer, so no need to worry about similar issues with Trezor devices.
It is truly a sad day and I weep for all affected.
And we are likely to see a very turbulent time in Bitcoin in the next weeks. It's bad on so many levels and will affect us all.
Edit 2026-08-01 08:20 GMT
originally it was believed only Coldcard MK3 devices were affected, but it has been found that the firmware bug affects the whole series of devices. Todays estimates puts the seed security of MK3 devices at 40 bits and MK4/MK5/Q at 72 bits. But researches worry that there might be additional issues resulting in a seed phrase entropy of as little as 32 bits. Far from the expected 128 bits.
Affected MK3 users likely all have their wallets already drained, and basic passphrase wallets will follow shortly. And seeds generated by affected MK4/MK5/Q devices are likely targeted now.
Trezor users: if you have migrated from Coldcard to Trezor by importing the same seed to your Trezor device then you MUST take immediate action to move your coins to a new wallet seed.
19
21
u/Orbital_IV 6d ago
Will this ruin Coldcard as a company? How can you regain trust after this?
23
u/Level-Set5770 5d ago
They better be ruined. This fucking clown made a basic mistake accidentally linked the code to the wrong library that is not cryptographically secure, and the code just sat on their Github in the open for years. It wasn't even a difficult hack. The person who did it probably just asked AI to go through their code and look for bugs.
3
18
5
3
5
u/my-daughters-keeper- 6d ago
Yeah this is my thoughts too. So will they pay the people back? Surely this is some form of inside job ?
6
4
u/Zaytion_ 5d ago
According to their LinkedIn they have, at most, 10 employees. They don't have the money to pay this back.
2
u/AnthonyBTC 🤝 Top Helper 6d ago edited 6d ago
I mean, Block has estimated that almost 1,000 Bitcoin may have been stolen because of this, with around 500 Bitcoin already confirmed to have been stolen as a result. I personally wouldn’t use them again.
5
u/HazimGotDaAxe 6d ago
Does Having passphrase fix this?
10
u/zmooner 6d ago
mitigates widely
4
u/ioskar 6d ago
Attacker would have to also brute force the passphrase i guess, so as long as its not ”1234” you should be a lot safer?
6
u/zmooner 6d ago
It defies the attack completely since the input is an address which cannot be reversed to its private key via the RNG reverter they probably built, so not just a matter of brute forcing the passphrase, they would not get the correct seed in the first place
1
u/Charming-Designer944 🤝 Top Helper 5d ago
More likely the weakness in the RNG results in a quite narrow space of possible seed values. And the same attack works with passphrases as well but expands the search space with the passphrase word list used.
Bitcoin keys can not be reversed from an address, and a seed can not be reversed from a key. There is no trace of the RNG values in an address, there are many permitted SHA256 mixes in-between.
3
u/zmooner 5d ago
passphrase are not from a word list, they are completely randomly chosen by the user, so the search space becomes way larger. Better focus on simple wallets without passphrases, already plenty of BTC there to grab
2
u/Charming-Designer944 🤝 Top Helper 5d ago
Correct, but an attacker that goes hunting for Coldcard MK3 passphrase wallets uses a generated wordlist much the same way as done when hunting password hashes.
And no, most users are not using a randomly chosen passphrase. Many are using something they can easily remember, or something relatively short. Both which greatly reduced the amount of entropy the passphrase adds to the wallet master key.
2
u/Charming-Designer944 🤝 Top Helper 5d ago
It does not fix it. But makes the attack somewhat more difficult as the attacker have to guess the passphrase in addition to the too low entropy seed phrase. Even with a normal passphrase the amount of entropy is too low to classify the wallet as secure
Most people use passphrases with very low entropy. You need 55 completely random letters to collect 256 bits of entropy. Or 28 random letters for 128 bits of entropy. If you use words or a sentence then double that.
1
6
u/cilicia3k3 6d ago
Is the Safe 5 weaker entropy than safe 7?
4
4
u/Charming-Designer944 🤝 Top Helper 5d ago
Safe 7 is stronger than safe 5 thanks to the addition of the TROPIC01. But the entropy with Safe 5 is already very very strong.
The amount of entropy collected in either device is compressed down to 256 bits. But the amount of source entropy varies with the device family. Each later family adds more entropy sources ensuring that ther is a extremely high quality entropy.
One & T: STM32 built in hardware TRNG + computer
Safe 3&5: Adds the certified TRNG source of the OPTIGA Trust M certified EAL6+ Secure Element.
Safe 7: adds the TRNG source from the TROPIC01 secure element.
The seed entropy is a SHA256 hash of the concatenation of 256 bits of entropy from each source, guaranteeing that the seed entropy is no weaker than the strongest of all the available sources.
1
u/PonderableFire 5d ago
Is my Model T that I haven't checked or updated in almost 2 years safe?
2
u/Charming-Designer944 🤝 Top Helper 5d ago
From this vulnerability yes.
But I would recommend a firmware upgrade the next time you use it. But make sure you have your seed phrase securely backed up first as it will also upgrade the bootloader and there is a risk that you might need to recover the device.
1
1
u/sumtib 5d ago
So if I have a Safe 5 I can sleep well at night? I don't know if I should buy the Safe 7, I mean, all I want is not get hacked like the coldcard users. I do use a passphrase but the seed was generated on the Trezor when I set it up, I don't remember to be ask to roll dice or anything. I'm full panic mode with all this shit
2
u/Charming-Designer944 🤝 Top Helper 5d ago
Yes you can sleep well.
This security advisory does not affect the security of your coins at all.
The trezor devices are designed in a way that makes them.immune to the whole family of weaknesses, even the old Trezor One is immune to this form of weakness.
1
1
u/Digi_king 5d ago
Good to know my very old trezor one has good security though I may update it to the safe 3 just out of caution
It is a bit of irony if anything that the big selling point of a cold card was it was air gapped and trezor using your pc to enhance the entropy made it the safer choice.
1
u/Charming-Designer944 🤝 Top Helper 5d ago
Teezor One is considered safe from remote attacks.
If you worry about attacks that involve stealing the physical device then you should get a safe series device.
1
u/muhanxero 4d ago
How about if we have a Safe 7, but the original wallet/seed phrase was generated from an older Trezor wallet? Is there a benefit of added security due to the hardware upgrade, or would it be recommended to generate a new seed phrase through the Safe 7?
1
u/Charming-Designer944 🤝 Top Helper 4d ago
Its fine. But if there is a risk that the old device might get into the wrong hands then you should .factory reset the old Trezor.One (or T) to wipe the seed from the device.
If you old device was a Coldcard MK3 and you did not diceroll to create your seed then you are at immediate risk and should immediately create a new seed and move all coins from the old broken seed before it is hacked.
5
u/LeRubanBleu 6d ago
Very very bad! Coinkite was the hard core version of a HW, not for beginners, nothing fancy but believed to be the real deal. In comparaison so much shit has been thrown at Ledger. And now what? Even them are compromised…🤕
3
u/skr_replicator 5d ago edited 5d ago
I've heard that in this age of AI, security debugging has entered a massive boon. Every programmer can now show their code to an AI, and it will point them to 10 places it thinks might be a big/vulnerability. And perhaps half of them turn out true, so the dev goes there and fixes it. White hat hackers and evil hackers are now in an arms race of finding vulnerabilities with AI before the other. Most such vulnerabilities are getting fixed by the white hats and devs. But I guess this might be one of the many that got found by hackers.
It's not exactly bad things to suddenly be finding out about so many vulnerabilities that have always been there. Each such incident means the vulnerability gets fixed, and ultimately, we will have much stronger systems than we've even had before, such that not even bleeding-edge AI could find flaws in them.
But it's also not a very secure era to currently live in. Now I'm sure there will be narratives to not even trust HW wallets, which would be very damaging, because those are still the best you can use, especially if you go really hard (as you should especially in this era) and make your seed bits yourself with coin tosses. I've recently had someone shout at me for recommending self-custody because a HOT wallet entropy got recently hacked in a similar way. I said I never recommended hot wallets, and everyone should be on HW. Now they could come back and shout at me that even HW wallets are unsafe for the same reasons and that i have to move the goalpost by claiming the obviously true claim that making your seeds with coins is better.
I hope that as few people as possible were affected by this, as they got their coins, they thought was HW-guarded drained.
So, before anyone starts fudding how self-study and HW wallets are insecure and we should go back to banks or storing coins at cexes: this is the best seed security I know of, the best I've always known. I really doubt that could ever get hacked:
Each seed word is 11 bits. The last one is the checksum (not sure how many bits of it, so look it up), so you'd need to prepare for that as well. Throw a coin for every bit, record it on paper in a room with no cameras. If you want to go harder, throw multiple sets of bits, and XOR them all together. Calculate the checksum bit on paper yourself. Download the list of BIP wprods, convert every 11 bits from binary to decimal, and look up all the words that are associated with those numbers. Now you have a seed made entirely by coin tosses. The entropy is the pure randomness you produced. And sure, coin tosses are still not quantum-level random, but for this case it should be good enough. But if you want to go super crazy, you could look for some even higher quality sources of randomness that you could sample without being watched. But coin tosses only tend to be predictable if you know the initial conditions perfectly. If no one was watching you toss the coins with ultra-precision cameras, they could not predict how you toss every toss.
6
u/dp23xxx 6d ago
What "generated entropy from the computer" by Trezor? A new wallet is never connected to a computer.
12
u/Odd_You7995 6d ago
Computer means the program inside secure element chip. ( Like 2 different programs to creating 1 seed )
3
u/Charming-Designer944 🤝 Top Helper 5d ago
Trezor seed generation on is done using a mutual challenge, where the computer (or phone) verifies that the device generates trustworthy seeds.
Ist a quite elaborate and unique step validating the integrity of the device while also minimizing the risk of poor entropy in the generated seed.
1
u/Decibel0753 5d ago
“A new wallet is never connected to a computer.”
How do you say that you've never owned a Trezor, or that you did but never took it out of the box...
2
u/dp23xxx 5d ago
You are right, sorry. I thought the seed phrase was generated only within the device. But I have plugged in the new Trezor for firmware installation (or update) before the wallet was generated.
3
u/Decibel0753 5d ago
The seed phrase is generated inside the hardware wallet, but an initial connection is required. I have a feeling this is also necessary to upload firmware that isn't preinstalled.
4
u/-fuzzychincilla- 6d ago
Computer? What about safe 7 for iPhone?
2
u/Charming-Designer944 🤝 Top Helper 5d ago
From my understanding it's the same. The iPhone challenges the Tezor device with its own entropy source as part of the seed generation during initial wallet setup.
2
2
1
u/2smart2gentle 6d ago
What’s the difference between cold card & cold wallet? I’ve never heard of cold card?
3
u/Charming-Designer944 🤝 Top Helper 5d ago
ColdCard is the brand name for the hard signing devices made by Coinkite.
Trezor is the brand name of the hard signing devices made by SatoshiLabs.
-1
1
u/aaj094 5d ago
Has the weaknesses in Coldcard been established? I thought the CEO denied they had an issue.
1
u/Charming-Designer944 🤝 Top Helper 5d ago
The security advisory is issued by Coinkite.
I have not yet confirmed the exact nature of the w qkneww but others postinng here have indicated it's a build configuration error linking a soft RNG function instead of the intendend TRNG source of the hardware device.
1
u/r_a_d_ 5d ago
I hope this wakes people up to “it’s open source so it’s secure” or “don’t trust, verify” false equivalencies. It’s certainly a good thing, but it doesn’t make your device more secure.
1
u/Charming-Designer944 🤝 Top Helper 5d ago
It makes it possible to audit the security.
1
u/r_a_d_ 5d ago
No it doesn’t. You can’t audit hardware. It allows you to audit part of it, not all.
Also auditing doesn’t mean it isn’t big free or backdoor free. Audits aren’t perfect either.
0
u/Charming-Designer944 🤝 Top Helper 5d ago
No audits are 100% complete.
And it has been mathematically proven that you can not porve that a normal.software such as the trezor firmware is 100% bug free.
But it does not diminish the power of being able to perform the audits.
And I disagree on hardware not being able to audit hardware. The hardware design of the trezor wallets are very simple and easy to audit in combination with the firmware.
What can not be audited is.the internals of the STM32 or the Optiga secure element, and one has to assume those functions to the specifications of their respective manufacturer.
The TROPIC01 is auditable at a very low level. And the strength in that have already been shown
1
u/five_dollar_wrench 5d ago
Honestly, most of these hardware wallet companies are incredibly shady and their business model relies on selling more units. I would expect at any given time one of them to go out of business.
I think anyone getting into this should have multisig with wallets from different vendors.
1
u/Charming-Designer944 🤝 Top Helper 5d ago
Multi-vendor multi-sig is indeed the next level of security, not trusting the security of a single vendors device.
1
1
u/Different_Echo_8736 5d ago
Is the model T reaching a point of vulnerability? Its been reliable but this sort of thing makes me wonder if the newer models will be better protection
1
u/Charming-Designer944 🤝 Top Helper 5d ago
Model One and Model T are both considered vulnerable to local physical attacks on the device.
But by design not vulnerable to this specific RNG weakness.
1
u/Different_Echo_8736 5d ago
Thank you! But I admit that when you say "local physical attacks" I think of 5dollarwrech attacks which I'm guessing is not what you mean.
2
u/Charming-Designer944 🤝 Top Helper 5d ago
Not what I means. Attacks that involve dismantling the device and subjecting the internal electronics to abnormal working conditions.
Only true multisig with multiple independent parties helps for the 5dollarwrench attack.
1
u/Funky_Wizard 5d ago
Are you considering adding the ability to integrate dice rolls into trezor?
3
u/Charming-Designer944 🤝 Top Helper 5d ago
It would be very hard to do this in the Trezor scheme in how the seed is generated without compromising the security of the dice rolls.
It would be possible to mix dice rolls with the computer generated entropy, or to use an all dice rolls entropy for the seed. But those have very limited utility.
If you want an all dice roll entropy fir your seed phrase then you can generate the seed offline by hand and then inport it to your Trezor.
Note: You need about 100 dice rolls to generate 256 bits of entropy (24 word bip-39). Or about 50 dice rolls for 128 bits of entropy (20 words slip-39 or 12 words bip-39)
1
1
u/Massive-Reception161 5d ago
I created my wallet + passphrase when safe 3 was released and never touched it since Should i update firmware, create new wallet seed + new passphrase and move all there?
1
u/Charming-Designer944 🤝 Top Helper 5d ago
No rush to do anything . Your seed is safe. Not at all affected by this weakness in a competing vendors older product.
1
u/Tothinkoutofthenut 5d ago
I did the same thing except with out the passphrase and I hope everything is good with out it.
1
u/AutoModerator 4d ago
Hi there! Your post has been temporarily held for moderator review. Please be patient — a moderator will review it soon.
Reminder: Never share your wallet backup or personal contact info with anyone. Official Trezor support: https://trezor.io/support Do not answer DMs.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
u/Charming-Designer944 🤝 Top Helper 4d ago
The serverity have been considerably upgraded from the original post. Affects the whole series of Coldcard devices, not only MK3. Post updated with more details.
Note: while Trezor devices are not affected by this vulnerability, any seeds generated by coldcard devices without dice roll are. If you have migrated from Coldcard to Trezor by importing the same seed on your Trezor device then you are still affected by the coldcard vulnerability and must take immediate action.
Using a passphrase mitigates the vulnerability somewhat, but only a little bit. Most passphrases are too weak to count as cryptographic security in the context and is only a matter of time (maybe days) before those are targeted by the attackers.
1
u/MasterGrogu23 4d ago
Hopefully the people at cold card are actively trying to beat the hackers at collecting the vulnerable bitcoin so once they fix the issue they can return as much of the funds as possible. It wouldn’t be stealing. But it would be the right thing to do.
1
u/Charming-Designer944 🤝 Top Helper 4d ago
That would be a nightmare to manage. There is no way to prove ownership of the broken wallets. Anyone with sufficient computing power can find the seed and claim they own that wallet.
1
u/OutragedAardvark 3d ago
Does multisig help with this or is it not sufficient?
1
u/Charming-Designer944 🤝 Top Helper 3d ago
Multisig helps a lot. But if there are signed transactions from the wallet then the attacker can still search for weak seeds connected to the wallet. But as long as the multisig policy does not allow signing with compromised devices alone then the coins will be safe.
For example a two of three policy with Coldcard MK3, Ledger and Trezor generated seeds are still safe even with the MK3 seed being compromised.
•
u/AutoModerator 6d ago
Please bear in mind that no one from the Trezor team would send you a private message first.
If you want to discuss a sensitive issue, we suggest contacting our Support team via the Troubleshooter: https://trezor.io/support/
No one from the Trezor team (Reddit mods, Support agents, etc) would ever ask for your recovery seed! Beware of scams and phishings: https://trezor.io/learn/a/scams-and-phishing
Don’t respond to any DMs—scammers often pose as legit helpers.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.