URGENT: Update your Coldcard or Create a New Seed Phrase / Private Key ASAP if you’ve created one on a Coldcard before today.
A post I read that explains the situation beautifully:
The Coldcard bug explained in simple terms:
Normally, a hardware wallet generates your 12 word seed phrase using true randomness.
Think of it like a lottery with roughly 340 undecillion possible tickets (that’s a 340 followed by 36 zeros). Every ticket has an equal chance of being picked, making the odds of guessing your seed essentially zero.
The bug didn’t shorten the 2,048-word BIP-39 word list. It changed how the wallet picked the words.
Instead of choosing from the entire lottery, the wallet kept picking from the same tiny corner because the “random” numbers were partially predictable from things like the device’s ID and timing.
Imagine that instead of 340 undecillion possible combinations, your wallet accidentally chose from only a few billion. That’s still a huge number, but astronomically smaller than what Bitcoin’s security is designed to provide.
Your seed phrase still looked completely normal. The words came from the same 2,048-word list. Nothing looked suspicious.
But for an attacker, the search space became millions of trillions of trillions of times smaller.
Credit: QuintenFrancois
