Your Keys Were Never Random: The ColdCard Entropy Failure
โWeb3 Devs Underground โ Emergency Session
โ๐จ Is Your Bitcoin Safe? ColdCard's RNG Failure and How Not to Lose It All
โAn emergency technical breakdown of the ColdCard RNG failure โ what actually broke, and whether your coins are at risk.
โ~1,816 BTC (~$114M) has been swept from about 5,294 Bitcoin addresses as of 3 August, across four suspected waves. It is still climbing. The wallets were ColdCards.
โAlmost every headline calls this a breach. It wasn't. A March 2021 build-configuration error routed seed generation to a software PRNG instead of the hardware RNG. Seeds carried ~40 bits of entropy instead of 128. Attackers regenerated the keys offline โ they never had to steal anything.
โWe called this session in 48 hours. One hour, three speakers, live Q&A.
โAbout the event:
โ๐ Brought to you by Web3 Devs Underground
โPowered by Masterkey VC
โ๐ Wednesday, 5 August 2026 | 19:00 IDT ๐ฎ๐ฑ | 18:00 CET | 12:00 EDT
โ๐ Live on X, YouTube & LinkedIn โ online, free
โโ ๏ธ Not our usual 17:00 slot.
โFormat: an open panel, not a lecture. Three speakers in conversation, different views, and your questions put to them live by the moderator.
โThe Panel
โ๐ค Avishay Yanai , Co-Founder & CEO, Soda Labs โ cryptographer, PhD Bar-Ilan, ex-VMware Research. On the cryptography: what 40 bits of entropy costs an attacker.
โ๐ค Boaz Bechar, Ex-Citi | Open Source Developer โ on what code review misses, and what a treasury on affected devices does this week.
โ๐ค Shauli Rejwan, Managing Partner, Masterkey VC ยท Co-Founder, Web3 Devs Underground โ on what changes for anyone shipping security-critical code.
โModerated by Amit Shilo, Community Manager.
โWhat we'll argue about:
โ- Was this a hack, a bug, or negligence?
โ- Five years in a public repo โ does "many eyes make bugs shallow" survive this?
โ- Does this prove self-custody doesn't work?
โ- Nobody tested that the RNG output came from the RNG. Tooling, culture, or incentives?
โAnd early on, the practical part: a live decision tree so you can tell whether your own coins are at risk.
โAgenda (Israel time):
โ19:00 - 19:04 | Opening remarks and how to ask questions
โ19:04 - 19:09 | Round 1: what actually happened โ three views
โ19:09 - 19:16 | Are your coins at risk? Live decision tree
โ19:16 - 19:38 | Rounds 2 & 3: how it broke, and was it avoidable
โ19:38 - 19:48 | Round 4: what changes now
โ19:48 - 19:58 | Audience questions
โ19:58 - 20:00 | One takeaway from each speaker
โNo price talk. No wallet recommendations. No attribution guesswork. Zero shilling, as always.
โAbout Our Sponsors:
โMasterkey Venture Capital is a global early-stage fund investing in top-tier innovative deep tech and Web3 infrastructure projects. With strategic presence in key crypto hubs worldwide, the team leverages nearly 50 years of combined expertise in advanced infrastructure, cryptography, cybersecurity, and energy solutions.
โGet Involved
โInterested in Speaking or Sponsoring? Contact Amit Shilo at @Amit_Shilo (Telegram) or fill out the Speaker application form.
โFounded by Shauli Rejwan and Roy Osherove.
โStay Connected
โWebsite: web3devs.org ยท Linktree: linktr.ee/web3devsunderground
โTwitter โ https://x.com/Web3_Devs
โYouTube โ https://www.youtube.com/@web3devsunderground/streams
โCalendar โ https://luma.com/web3devs_underground
โRegister: https://lu.ma/web3devs_underground
โSee You There!