Coldcard Q: a device built by paranoid cryptographers, and why that paranoia just got vindicated
These days it’s hard to get surprised by a device or its design. I’d already tried the obvious cold wallets, Ledger and Trezor are the comfort champions, when I stumbled on something odd, ordered it, and burned part of a weekend figuring it out.
The Coldcard Q looks like it was designed by cryptographers with a persecution complex. Every part of it answers the question “what if someone actually tries to steal this?” Some of what’s packed in:
Fully air-gapped: no Wi-Fi, no Bluetooth, no USB. Transactions get signed only via microSD, QR code, or NFC.
A Secure Element that holds private keys in an encrypted zone, inaccessible even if someone cracks the case open.
Two independent chips from two different manufacturers, with cryptographic functions split between them, compromising the device means breaking two separate hardware architectures at once.
Anti-tampering: the device logs attempts to open it. Pull it out of a safe and see the indicator light in the wrong color, and you know someone tried.
Open-source firmware, so anyone can audit it themselves instead of taking the company’s word for it.
An e-ink screen and a mechanical keyboard - no extra sensors, no side channels to leak through.
AA batteries instead of a built-in one: you can power it down completely and know it’s silent, and batteries won’t leak and ruin the internals over time.
A manual entropy input on the random-number generator, you’re supposed to roll dice and type in the result yourself. I was surprised how many “hack the standard RNG” videos are floating around on YouTube; the fear behind this feature isn’t paranoia, it’s precedent.
Anti-supply-chain protection: sealed factory packaging, with firmware checked for tampering before use.
A Brick-Me PIN and a Duress PIN - instant wipe, or a fallback into a fake wallet.
Decoy wallets, where you can stash a small real balance to hand over if someone forces the code out of you.
The Q looks like a retro calculator on the outside, and it actually runs a calculator mode and a built-in flashlight. The discreet mode isn’t a design flourish, it’s part of the threat model. It’ll also hold encrypted secure notes: backup phrases, instructions, seed fragments, key reminders locked behind the same PIN mechanism guarding your coins.
It’s not a comfortable device to use day to day. But it’s a working manual on cryptographic paranoia, built into a case with AA batteries, a snitch LED, a calculator, a flashlight, and notes nobody can read without your PIN.
How “don’t trust, verify” broke at step one
Coldcard built its reputation on Don’t Trust, Verify. Open-source code, reproducible firmware, the ability to check everything yourself.
The problem turned out to be in the very first action: generating the seed phrase.
Coldcard gave you three options: trust the hardware random number generator, add dice rolls on top of it, or build the seed entirely from dice. That last option meant not trusting the hardware at all. Almost everyone picked the default anyway - press the button, trust the device.
In 2021, a bug shipped in the firmware that disabled the hardware randomness generator. In its place, the device fell back to MicroPython’s weak software generator. No warnings appeared. Users got a normal-looking set of 24 words: checksum passed, wallet restored, and the words could sit on a metal plate for years.
But a seed’s security isn’t in the words, it’s in the entropy, the size of the space they were drawn from. On some devices that space shrank to roughly 40 bits, on others to 72. Still huge numbers for a person, but reachable for a well-organized brute-force attack.
Galaxy Research estimated around 1,367 BTC, close to $90 million, was drained from vulnerable addresses.
That’s when I went and checked my own Coldcard. Sure enough, my version was exactly the vulnerable one. Rolling dice for honest entropy was something I’d been too lazy to do back then, I pressed the button like everyone else. Lucky twice over: there wasn’t much money in the wallet, and it wasn’t touched.
There’s a separate story here about AI’s role. Coinkite itself suggested the attacker may have found the bug through AI analysis of the open-source code while the company’s own AI audit, run just weeks earlier, found nothing. The defender has to catch every bug. The attacker only needs one.
For years, the assumed threat to cryptography was quantum computers. But nobody broke Bitcoin here, and nobody brute-forced a full 256-bit key.
What got broken was weak generation, caused by an ordinary code bug, quite possibly found and scaled with the help of AI.
Reproducible builds proved the firmware matched the source code. They never proved the code itself was safe.
Why the paranoia was earned, the numbers keep climbing
Since that first estimate, Galaxy Research has tracked the fallout across three separate attack waves. The first hit on July 30, draining roughly 1,083 BTC from about 1,200 addresses in just 41 minutes. A second wave surfaced days later, and a third - with a noticeably different transaction pattern, possibly a different actor working the same weakness pushed the running total to 1,367 BTC across 4,585 addresses, worth close to $88.6 million at time of writing. Galaxy says the activity may still be ongoing, and that coins taken so far have sat untouched in attacker-controlled addresses rather than being moved or cashed out. The drained coins had been sitting dormant for years on average, this looks like long-term self-custody holders, not exchanges or institutions.
Some reporting says the Mk4/Mk5/Q line escaped this particular bug entirely; Coinkite’s own advisory says otherwise, specifically flagging Q seeds generated before firmware 1.5.0Q or Edge 6.6.0QX. The honest answer is: it depends on exactly which firmware your seed was generated under, and that’s not something to take on faith from a headline, it’s something to check on the device.
Which brings the story back to that dice-roll entropy input. It’s the one feature on this list that isn’t about defending the device from an attacker, it’s about not needing to trust the device’s randomness in the first place. Coinkite itself now says seeds backed by at least 50 independent, honest dice rolls aren’t exposed to this flaw at all. I used it going in mostly because it seemed like the “hardcore” option. Turns out it was the only one actually built for a world where the manufacturer can ship a bug like this and where the defender has to catch every bug, and the attacker only needs one.