Is your Ledger still safe after the Coldcard vulnerability?

The discovery of a serious security flaw in certain Coldcard firmware versions has rattled the crypto community. The problem lies not in the theft of private keys from the hardware wallet itself, but rather in the generation of the seed phrase. Ledger states that its devices are not affected by this vulnerability and uses its own system for random number generation.

In short

• Coldcard Mk3 used insufficient random data when creating seeds, allowing attackers to theoretically guess them.
• Ledger says it uses its True Random Number Generator in the hardware chip, which guarantees full 256-bit entropy.
• Not everyone faces the same level of risk: it depends on your firmware version, whether you used a passphrase, and how your seed was generated.

What went wrong with Coldcard?

Coinkite discovered that specific firmware versions of the Mk3 used insufficient random data. A hardware wallet is supposed to create a seed with 256 bits of full entropy, which yields approximately 2^256 possible seeds. This number is practically impossible to search through. With the affected Coldcard Mk3 firmware (4.0.1 and later), however, the effective entropy is only around 40 bits. By comparison, 256 bits is impossible to guess, but 40 bits is realistically achievable for a well-funded attacker.

The attack works as follows: an attacker can generate millions or billions of possible seeds offline, derive Bitcoin addresses from them, and compare them with addresses on the blockchain. Once he finds a match, he knows your seed and can derive your private keys. All of this without ever having had your Coldcard in his possession. With other Coldcard models (Mk4, Mk5 and Q), the effective entropy is around 72 bits, which makes the problem less serious but does not eliminate it entirely.

When are you at risk?

Your risk is high if you used an Mk3 with affected firmware, had the seed generated on the Coldcard itself, did not use an additional BIP39 passphrase, and have a standard single-signature wallet. In that case, your seed may originate from a much smaller search space.

Your risk is much smaller or non-existent if you generated the seed entirely with dice, used a strong and secret BIP39 passphrase, used multisig with hardware wallets that are not affected, or created a new seed after the firmware was repaired. A passphrase acts as an additional secret on top of the 24 words. Even if an attacker knows the seed, he still lacks the passphrase, which makes brute forcing practically infeasible.

Why Ledger is not vulnerable

Ledger uses a True Random Number Generator that is physically located in the Secure Element chip. This means that the randomness comes from hardware, not from a software algorithm. Every new seed therefore receives full 256 bits of entropy. There is no small set of possible seeds that an attacker can search through. Ledger has been using this fundamental approach since 2018.

This does not, however, necessarily make Ledger safer in all respects. The main lesson from this incident is that the security of a hardware wallet depends not only on the Secure Element, but also on the implementation of the random number generator. A single mistake during seed creation can still lead to the loss of funds years later.