xmr.club
The Coldcard incident, in plain terms
A hardware wallet's most sensitive job is generating your seed — the 12 or 24 words that mathematically become your private keys. That generation needs high-quality randomness. If the randomness is weak, an attacker who understands the pattern can guess seeds, drain funds, and vanish. The wallet works normally the whole time. Nothing looks wrong until money moves.
According to Coinkite's own security advisory, seeds generated on Coldcard Mk3 firmware 4.0.1 (March 2021) through 4.1.9 had substantially less entropy than specified. Newer models — Mk4, Mk5, and Q — were also affected in pre-fix firmware, producing around 72 bits of entropy instead of the expected 128. The bug lived in the firmware for approximately five years without being caught by internal review, public code inspection, or external audit.
The observable impact: on 2026-07-30, roughly 594 BTC — about $38 million — were drained from around 500 Coldcard wallets in under 30 minutes. Chainalysis reports the attacker prioritized the largest wallets first, consistent with someone who had precomputed the seeds in advance and swept when a signed transaction from any of them broadcast the corresponding public key.
Coinkite has shipped fixed firmware for every affected model. Critically: installing the fixed firmware does not repair an existing seed. Users of any affected version must generate a new seed on fixed firmware (or on a different device entirely) and migrate their funds. Importing the compromised seed into a different wallet application does nothing — the seed itself is the vulnerable object.
An exception exists for users who generated their original seed using at least 50 independent, private, fair dice rolls added to the device entropy. That user-supplied randomness was strong enough to overwhelm the weak on-device RNG. Users who protected their wallet with a strong, unique BIP-39 passphrase have reduced immediate exposure but should still migrate, because the passphrase does not repair the underlying seed.
Why this matters for Monero users
Coldcard is a Bitcoin-only device. No XMR funds were touched. So why is this on xmr.club?
Because the story is not really about Coldcard. It is about a class of bug — a weak or subtly broken random number generator in vendor firmware, undetected for years — that can happen to any hardware wallet, from any vendor, running any firmware. Coldcard's implementation was open source. It was reviewed by multiple third parties over its lifetime. The bug still lived for five years.
Every hardware wallet you might use for Monero has an RNG in its seed-generation path. If that RNG is weak — through vendor error, through a supply-chain compromise, through a firmware update that introduces a subtle regression — the failure mode is identical: your wallet appears normal, and one day an attacker who understands the pattern sweeps your funds. There is no external symptom to warn you.
This is not the first "long-hidden bug surfaces years later" incident in the crypto ecosystem in 2026, and it will not be the last. AI-assisted code auditing has made large-scale review of firmware and cryptographic implementations dramatically faster; expect more bugs to surface in code that has been in public view without incident for years.
The takeaway is not "distrust hardware wallets." Hardware wallets remain a substantial improvement over storing seeds on general-purpose computers. The takeaway is: understand what you are trusting, per vendor. Then use the options Monero gives you to reduce that trust footprint.
Your options for Monero on hardware, as of 2026-08
Three vendors currently offer first-party Monero support on their hardware wallet product lines. They differ significantly in what you are being asked to trust.
Ledger — the longest-running Monero HW option, with the heaviest trust footprint
Ledger devices run closed-source firmware inside a certified Secure Element chip. The Secure Element contains a hardware True Random Number Generator (TRNG); per Ledger's own statement, this TRNG is certified and produces the full 256 bits of entropy for a 24-word seed. Ledger has integrated Monero support since 2019; the integration is stable and used at scale.
What you are trusting technically: Ledger, the company, to (a) have implemented the TRNG correctly, (b) have implemented the seed derivation correctly, (c) not have introduced a regression in any firmware update, and (d) not to be compromised at the supply chain or firmware-signing level. You cannot verify any of these directly, because the firmware inside the Secure Element is not published.
What you are trusting operationally is a longer list. Ledger has been through four documented incidents that matter for a privacy-motivated user, and none of them touched wallet keys — which is precisely the point:
- July 2020 — e-commerce database breach. ~270,000 customer records exfiltrated, including names, postal addresses, emails, phone numbers, and product-purchase history. The physical addresses were later weaponized: users received extortion letters at their homes, and in documented cases threats of home invasion. No wallet keys were exposed; the harm was privacy-based, not custody-based, and it was severe.
- May 2023 — Ledger Recover. An opt-in firmware feature that can extract the 24-word seed via a firmware update. The mere existence of the feature proved that Ledger has always had the technical ability to extract seeds through firmware updates. The service remains active in 2026 despite significant community backlash.
- December 2023 — Ledger Connect Kit supply-chain attack. Malicious code was injected into Ledger's
@ledgerhq/connect-kitnpm package, causing DApp users to sign wallet-draining transactions. Sushi publicly warned users "do not interact with ANY dApps". Not a hardware bug — a demonstration that Ledger's software supply chain has been compromised. - January 2026 — Global-e e-commerce breach. Ledger confirmed on their support site that customer names, postal addresses, emails, phone numbers, and order details were exposed via their e-commerce partner Global-e. As with 2020, wallet keys were not touched; but the same customer base was re-exposed in the same class of leak that had already produced years of physical-threat consequences. Publicly surfaced by ZachXBT on 2026-01-05.
- April 2026 — Fake Ledger Live app on Apple's App Store. A malicious clone of Ledger Live from a developer registered as "SAS Software Company" passed Apple's review process and stayed live for approximately one week (April 7–13, 2026), draining an estimated $9.5 million from 50+ users who were prompted for their 24-word seed at setup. Apple removed the app on April 16 after ZachXBT publicly documented the theft pattern. This is not a Ledger firmware or database bug — it is impersonation — but it is at least the second documented case (a near-identical fake also passed Microsoft's Windows store review in 2023, costing users ~$600,000 before removal) of a fake Ledger Live variant clearing a major-platform review, with real losses recorded before either the platform or Ledger detected it. Ledger's brand-impersonation monitoring has not been the discovery channel for either event.
For a Monero user specifically, the physical-address leaks are a substantial concern in a way they may not be for a mainstream Bitcoin holder. Monero's design defends privacy at the protocol layer; buying the device that holds your XMR from a vendor whose customer database keeps ending up in extortionists' hands partially defeats the purpose. If this concern applies to you, buy through in-person channels or via non-Ledger resellers, and treat the device shipping address as sensitive.
Trezor — Safe 3 / Safe 5 / Safe 7, added 2026
Trezor's Safe series added a Secure Element to their earlier open-source firmware approach. Monero support was added in 2026, integrated through Cake Wallet on desktop and mobile. Trezor's seed generation combines entropy from the connected host computer with entropy from the device itself; this mixing means a weak device-side RNG can be partially mitigated by strong host entropy, and vice versa. The firmware is open source and audit-friendly.
What you are trusting: Trezor, the company, plus the reviewers who have looked at the open firmware, plus the correctness of the host-side entropy sourcing on your specific computer. Older Trezor Model One and Model T devices are not the Safe series and are outside this analysis. Trezor's public history includes a physical-extraction vulnerability on Model One / Model T via voltage glitching (2020) — not an RNG bug, but a reminder that even open-source firmware can have physical-attack surface.
Keystone 3 Pro — air-gapped, Monero-specific SKU
Keystone 3 Pro is a QR-code-only, fully air-gapped device: it never connects to a computer or phone via USB, Bluetooth, or Wi-Fi. All communication happens through the camera, scanning QR codes back and forth. Keystone sells a distinct KV032-Monero product bundle specifically for Monero users, integrating with community Monero clients. The firmware is open source; the KeystoneHQ organization also maintains a fork of Cuprate, the experimental Rust Monero node — a signal that Monero support is not incidental.
What you are trusting: Keystone, the company, plus the open firmware reviewers. The air-gap has an interesting property specifically for the RNG-bug class: even if the device's RNG is weak, an attacker with no network channel to the device cannot exfil the seed remotely — they can only compromise you if they already know your public keys AND independently deduced your seed from the RNG pattern (as happened in the Coldcard case). This is not immunity, but it is one fewer attack path than USB-connected devices.
OneKey previously offered Monero support and has since removed it; it is not a current option for XMR holders.
The Monero-specific mitigations
This is the section that matters. Monero's wallet architecture gives you options a Bitcoin user does not easily have — options that let you reduce the trust you are placing in your hardware wallet's RNG.
Split view key and spend key
Every Monero wallet has two private keys: a view key (lets the holder see incoming transactions and balances) and a spend key (lets the holder actually move funds). You can put the view key on one device and the spend key on another. The most useful pattern here: hardware wallet holds only the view key, spend key is generated separately from user-supplied entropy and kept air-gapped or offline. If the hardware wallet's RNG is later found to be weak, the attacker learns your view key — they can see your balance but cannot spend a single piconero.
Restore from user-supplied entropy — bypass the RNG entirely
monero-wallet-cli can restore a wallet from a seed you generate yourself. Roll 50 or more fair, private dice rolls, convert the result to a compatible mnemonic using an offline tool (or the standard SLIP-0039 process), and pass that mnemonic to monero-wallet-cli --restore-deterministic-wallet. You have now created a Monero wallet whose seed does not depend on any hardware vendor's RNG. Ever. This is the strongest single mitigation available against the RNG-bug class. It is not practical for beginners — the dice-roll process is tedious and easy to do wrong — but for large holdings it is proportionate.
Subaddresses for partial isolation
A single Monero seed generates unlimited subaddresses, each unlinkable on chain from the others. This does not defend against a compromised seed (all subaddresses share the same private keys), but it does let you compartmentalize risk across use cases: a subaddress for merchant payments, another for exchange withdrawals, another for cold storage. If you later suspect one channel of your seed is exposed, the on-chain linkability of subaddresses is what matters — and Monero's subaddress design keeps that at the theoretical minimum.
View-only wallets on untrusted devices
Because Monero's view key is separable, you can load a view-only wallet on a phone, a browser, or any device you do not fully trust — check your balance, watch for incoming payments, run merchant terminals — without exposing any spending authority whatsoever. The spending key stays air-gapped. Bitcoin's model does not offer this cleanly; watch-only wallets exist but the abstraction is not first-class.
How you buy matters as much as what you buy
Every hardware wallet vendor keeps a customer database — names, shipping addresses, payment methods, order history — and every such database is a phishing and extortion target. Ledger's 2020 and 2026 breaches are the case study, but the same failure mode is structurally available to any vendor that takes online orders. If you buy a "security device" with your real ID, your real home address, and a credit card, the vendor's customer database is a list of confirmed crypto holders with home addresses attached. When (not if) that database ends up somewhere it should not, you are on it.
To reduce your exposure:
- Pay in cash or Monero, not credit card. This removes the identity-linkage between the transaction and your real name.
- Ship to a mail drop, PO Box, or a friend's address — not your primary residence. A leaked shipping database becomes an extortion target only when it maps device owners to real front doors.
- Buy in-person where practical. Cash-and-carry at a physical crypto shop or electronics retailer removes both the vendor customer database and the shipping database from the exposure equation.
- Do not buy through marketplaces that already know you (Amazon, eBay tied to your primary account). Their customer database is another surface with the same class of risk.
None of this is Ledger-specific. Trezor, Keystone, and any future vendor that sells physical devices online will keep a customer database, and that database will eventually leak — through their own systems, through a payment processor, through a fulfillment partner. Anything else is self-doxxing.
Reader takeaway
No vendor rankings here. That would be dishonest — you know your own threat model and stakes better than we do, and the "best" wallet depends on which trust surface you consider least risky.
What we recommend instead:
- Diversify across vendors if your stakes justify the operational cost. Splitting a large stash across a Ledger, a Trezor Safe, and a Keystone 3 Pro means no single vendor's RNG or firmware bug takes you to zero.
- Roll your own entropy if you do not want to trust any single vendor's RNG. For very large holdings this is proportionate. Use the
monero-wallet-clirestore path above. - Watch vendor security advisories. Every vendor listed here publishes them. Subscribe. Read them the day they land, not the week the news reports them.
- Verify firmware version before generating a seed. The Coldcard bug was fixed in newer firmware — but users who had already generated on the affected version were not helped by the update. If you buy a new device, update it to the current fixed firmware before generating any seed.
- Do not lock in on a single brand. The lesson of the past six years — Ledger's 2020 and 2026 e-commerce breaches, Ledger Recover, the Ledger Connect Kit supply-chain compromise, the Ledger Live impersonation apps that passed Windows (2023) and Apple (2026) store reviews, Coldcard's RNG bug, Trezor Model One extraction — is that every vendor eventually has a bad news day, and some vendors have several. Redundancy protects you from every one of them.
The Coldcard advisory is at blog.coinkite.com/coldcard-mk3-seed-generation-warning/. If you own an affected device, read it today.