Luke Dashjr Lists Nine Coldcard RNG Flaws, Disputes 'Only AI Could Find It' Claim

Bitcoin Core developer Luke Dashjr published nine concerns about Coldcard's random-number generation code on Monday, saying he had raised them privately with manufacturer Coinkite first and went public to rebut the claim that only a "genius AI" could have found the wallet's defects.

"It's been long enough, and I hear nvk is going around pretending humans couldn't find the Coldcard defect," Dashjr wrote in a thread on X. Rodolfo Novak, known as nvk, is a Coinkite co-founder.

Dashjr was blunt about the framing. "But the claim that only a 'genius AI' could find issues with the RNG is a blatant lie," he wrote. He said he doesn't know whether Coinkite fixed the items after his private report, and he stopped short of calling every item exploitable or a confirmed bug.

What exactly did Dashjr flag?

His first item concerns a TODO note in rng_init, the routine that initializes the Mk4's random-number generator. Some STM32 chips appear to require discarding the first sample, he wrote.

The other items stack up quickly:

• The driver ignores the chip's seed-error and clock-error bits.
• The STM32 manual calls for extra post-processing for cryptographic uses.
• The random_buffer function detects repeated RNG output, but direct calls to rng_get bypass that check.
• rng_get_or_fault can't be considered safe until the random_buffer check is proven redundant.
• If STM32 output became deterministic, the secure element's randomness should still hold entropy at the full 256 bits.
• The replacement code amounts to a novel RNG that needs full testing.
• The patch disables the old PRNG only at build time; Dashjr wants a runtime assertion.
• An RNG timeout in the wrong context could trigger undefined behavior — possibly a crash that risks bricking slow devices.

What did Coinkite already fix?

Coinkite's technical backgrounder of July 30, 2026 said the firm was "unaware of the bug until today." The company theorized an external party may have used AI on its open-source firmware to find the vulnerability ahead of time, and noted its own AI-assisted review weeks earlier had not caught it.

The root cause was a firmware change from March 2021 that moved seed generation off the hardware random-number chip to Yasmarang, a software tool fed by the chip's serial number and a timer. Mk2 and Mk3 seeds carried roughly 40 bits of real randomness — far below the 128 bits BIP-39 assumes — and attackers reconstructed weak seeds offline.

Coinkite shipped fixes: firmware 5.6.1 for the Mk4 and Mk5, and 1.5.1Q for the Q on August 20. The security update cited "AI-assisted review by Kimi and other frontier models" and thanked outside researchers.

Some of those changes overlap with Dashjr's list. The firmware now checks the hardware RNG's seed-error state and discards the next 12 hardware words after a recoverable error. A boot check confirms rng_get() hits the hardware read path. The backup generator now uses SHA-256 Hash_DRBG.

What's the fallout?

Thefts began July 30, when an attacker drained about 594 BTC — roughly $38 million — from some 500 wallets in 25 minutes. Some outflows were whitehat rescues, but cumulative losses are estimated above $140 million.

Coldcard customer Amir Reza Naderi has filed a proposed class action in the Ontario Superior Court of Justice against Coinkite, Novak and co-founder Peter D. Gray. He alleges they knew about the seed-generation problem since May 2025 and failed to warn users. Coinkite denies the claim.

With Dashjr's nine items now public and only partially addressed in shipped firmware, expect pressure on Coinkite to confirm which fixes landed — and for the Ontario court to weigh whether the alleged May 2025 knowledge holds up.