Roughly 594 BTC, about $38 million, left a set of Bitcoin wallets in a 25-minute sweep this week. There was no phishing site, no malicious signature request, no leaked seed phrase written on a bit of paper in a drawer. The keys were guessed, because a flaw in how an older generation of Coldcard hardware wallet generated seeds made “impossible to guess” merely difficult. Coinkite has since told Mk3 owners to migrate their funds while the industry works out how far the damage goes.
Read that again, because the detail that matters is easy to skim past. The device did not get hacked. It did what it was designed to do, produced a number, and handed it over. The number just was not as random as everyone believed. And nobody could tell, for years, by looking.
TL;DR
- A seed-generation flaw in older Coldcard hardware wallets made supposedly unguessable keys guessable, and roughly 594 BTC ($38M) was swept in about 25 minutes once someone worked it out.
- Randomness is the only security primitive whose failure produces output identical to success. A broken signature is rejected, a broken decryption returns garbage, a broken random number returns a perfectly ordinary-looking number.
- This flaw survived in open-source, security-obsessed, air-gapped hardware built by paranoid professionals. “Use a reputable implementation” is not a defence, it is the exact thing that failed here.
- Entropy failures are retroactive and total. The moment the weakness is known, every key ever generated by that path was always weak, including the ones that felt safe yesterday.
- Crypto games ask you to accept the same unfalsifiable promise thousands of times a day, from a server you cannot inspect, run by someone who profits from the outcome.
- The fix is not better entropy. It is entropy that carries a proof. Chainlink VRF publishes a number alongside a cryptographic proof that is verified on-chain before the result touches the game contract.
The one failure mode you cannot see
Cryptography is unusually good at failing loudly. Feed a verifier a bad signature and it returns false. Corrupt a ciphertext and decryption blows up. Change one byte of a file and its hash is unrecognisable. Every one of these primitives has a built-in mechanism that says this is wrong, and it says it immediately, to anyone who bothers to check.
Randomness has no such mechanism. A weak random number and a strong random number are indistinguishable as artefacts. You can stare at 256 bits from a compromised generator for the rest of your life and never know. You can run statistical test suites on the output and pass them all while a subtle bias in the seeding path quietly collapses your keyspace from astronomically large to brute-forceable on rented hardware. The output looks fine because the output is supposed to look like nothing in particular, and it does.
That is what makes this story worse than the usual wallet drain, not better. Coldcard is open source. It is built by a company whose entire product is paranoia, sold specifically to people who take custody seriously enough to buy dedicated air-gapped hardware rather than trust a phone. It has been picked over by exactly the audience most likely to find something like this. And the flaw still sat in the field, silently, until someone with bad intentions got there first and emptied 594 BTC in less time than a coffee break.
If that pipeline can produce an entropy bug, so can everything less careful than it. Which is nearly everything.
Retroactive, total, and instant
The second brutal property of entropy failure is that it reaches backwards.
When a smart contract is exploited, the loss is bounded by what was in the contract at that moment. When a random number generator is discovered to be weak, nothing changes and everything changes at once: every key it ever produced was always guessable, and every wallet derived from those keys has been sitting in public view for years waiting for someone to do the arithmetic. There is no patch that saves the funds already generated. There is only migration, and only for the people who hear about it in time.
Now port that property to gaming, because it transfers exactly.
If a platform’s random number generator turns out to be weak or seeded predictably, it does not mean future games are unfair. It means every game it ever ran was never random. Every result on the leaderboard, every jackpot, every hand you lost at three in the morning and put down to variance. All of it, retroactively, was drawn from a smaller box than you were told. And unlike a wallet, there is nothing left on chain for anyone to audit afterwards.
Why gaming is a harder problem than wallets
Wallet entropy is at least eventually falsifiable from the outside. Keys leave addresses. Addresses leave a public trail. Researchers can and do scan the chain for the fingerprints of weak key generation, which is broadly how flaws like this surface at all, however late.
Game outcomes leave no equivalent artefact. A run of a thousand house wins produced by a rigged generator and a run of a thousand house wins produced by genuinely rotten luck are the same public record: a list of results. You cannot distinguish them without the seed, and the seed is on a server you will never see. There is no forensic technique that recovers fairness after the fact from outcomes alone.
Three differences make this considerably worse than the wallet case:
- Frequency. A wallet generates entropy once. A game generates it every single round, thousands of times a day, forever.
- Custody of the process. Your wallet generates its number on hardware you physically hold. A game generates its number on infrastructure you have no access to, no visibility into, and no ability to test.
- Incentive. Coinkite had every commercial reason for your entropy to be strong. A gaming operator running server-side RNG is the one party who profits when it is not. The Coldcard failure was a bug. In gaming, the identical failure is indistinguishable from a business model.
You cannot audit randomness, so stop trying
The lesson people will draw from this week is “use better hardware” or “trust a more audited vendor”. That lesson is wrong, and this incident is precisely the evidence that it is wrong. The audited vendor was the one that broke.
The only durable answer is to stop treating randomness as something you assess by reputation and start treating it as something that must arrive with a receipt. A verifiable random function does exactly that. Chainlink VRF does not ask you to believe the number is random. It produces the number together with a cryptographic proof, generated from the oracle’s private key and a seed nobody controls alone, and the VRF coordinator contract verifies that proof on chain against the oracle’s public key before the value is ever delivered to the game contract. A number that does not match its proof does not get used. The transaction fails.
That single property converts randomness from the silent failure mode described at the top of this article into a loud one. Nobody has to notice a subtle bias, because a manipulated value cannot survive verification at all. The check is not a policy, an audit schedule or a promise in a whitepaper. It is a line of contract code that runs every time, for every player, whether anyone is watching or not.
This is why Satoshie was built on Chainlink VRF on Base rather than on a well-tested random number library and a strong assurance that we would behave. Our word is worth the same as every other operator’s word, which is to say nothing, and the architecture is designed so you never have to take it. Every raffle draw and every coinflip resolves in a VRF callback whose randomness carries a proof that anyone can inspect on BaseScan, long after the game is over.
594 BTC vanished in 25 minutes because a number that looked fine was not. The uncomfortable question for crypto gaming is not whether the same thing could happen to a platform you play on. It is that if it already had, you would have no way of knowing.
📷 Photo by Jonathan Petersson on Unsplash
