Open source. No radio, ports, or RNG inside.
Dice, coins or cards in. A valid seed phrase out. Nothing inside to fail you, and you can check its work before any money touches the seed.
No product yet. No price yet.
On the list. You will hear from us once, when there is hardware.
That didn't go through. Wait a moment and try again.
Open source design study. Nothing is tooled, nothing is for sale.
First, the part that cannot wait
None of this requires buying anything from us or anyone. If your coins sit behind a Coldcard seed, start at step one. If you just want a seed you made yourself, start at step two.
Those seeds are inside brute force range and sweeps are running now. Get the coins off that seed first, to any wallet whose seed was not born on affected firmware, then rebuild properly. The emergency livestream below walks the fastest safe path with Sparrow.
About 72 bits against a promised 128. Not sweepable tonight, but the margin is gone and the clock is not your friend. Update the firmware (5.6.0, or 1.5.0Q on the Q), generate a fresh seed, move the coins. A strong passphrase on the old seed is a reasonable stopgap while you migrate, not a destination.
Use dice mode with a full ninety-nine rolls, which the emergency guidance rounds to one hundred, or 256 coin flips. Enter each throw as it lands, verify on something offline you would trust with the seed, and send a test amount before the balance.
The vendor statement, from the vendor's account.
The fastest safe exit for affected seeds, walked through live, passphrase included.
The official steps. Updating alone repairs nothing until a new seed exists and the coins have moved.
The desktop wallet the migration guides lean on. Export your new wallet into it and watch the coins land.
The remediation walkthrough. Firmware, fresh seed, moving the coins.
Coin flip entropy, end to end, nothing needed but a coin and patience.
How to replay your rolls on independent tools and confirm the words match.
Download it, run it offline. Never feed real rolls to an online copy. The rolls are the seed.
Affected versions, fixed versions, and which seeds were never at risk.
What actually broke, line by line, if you want the whole story.
Draw your words from a jar of 2,048 tiles. You still need a device for the final checksum word, which tells you exactly why this page exists.
Shirriff's famous 0.67 hashes per day, for anyone who wants to know why nobody computes the checksum by hand.
30 July 2026
The seeds were recomputed from scratch. Since March 2021, Coldcard firmware had been calling a deterministic software PRNG instead of the hardware RNG, because a build flag was checked for being defined rather than for being enabled. Defined but set to zero read as true. Seed generation quietly fell through to a toy generator seeded from the chip's serial number and a boot timer.
How long it shipped before anyone caught it. Through audits, through reviews, through every version release note.
Effective entropy on Mk3 seeds, against a 128 bit target. Forty bits falls to rented hardware in hours. Later devices managed about 72, which is not trivially crackable, but a fraction of the promised margin, and nobody knew either number for five years.
A seed born weak stays weak. Every affected holder has to generate a fresh one and move every coin to it, by hand.
Not by inspecting the device, not by checking your words, not by any test available to you. A broken generator's output looks exactly like a working one's.
Every number above comes from Coinkite's own technical backgrounder and Block Engineering's analysis. Read the primary sources, not us.
The exception
Seeds generated with at least 50 fair, independent, private dice rolls are not at risk from the RNG issue, regardless of firmware version.
Coinkite, technical backgrounder, 31 July 2026
Regardless of firmware version. Everyone who rolled dice was fine on every affected build, for five years, with no advance warning and no idea they were being protected. Physical entropy was the only path that did not depend on a vendor being correct.
The obvious objection, stated fairly
Casa's chief executive answered the incident by saying you just cannot ask people to roll dice to be secure with self custody, and called it a non starter for 99% of people.
He is right about the experience as it exists today. Ninety-nine numbers, written by hand, typed into a device that also holds your keys, with no way to tell whether digit 47 landed where you thought it did. That is not a cryptography problem. That is an interface nobody bothered to build.
What it is
There is no RNG in this device. No noise diode, no entropy pool, no seeded PRNG, no fallback path, no secure element quietly topping anything up.
If we shipped the exact Coldcard bug tomorrow, nothing would happen, because there is no line of code where the device picks a number. The only entropy that reaches your seed is entropy you made in the room, with an object you can hold.
The device does exactly one job: your roll string is hashed with SHA-256, that hash becomes the BIP-39 entropy, and the standard BIP-39 encoding turns it into words, checksum included. Nothing else happens. Write your rolls on paper alongside your words.
First, the rule that outranks everything else here: your rolls are your seed. Anything that sees them can compute the words. Check the device with a practice round first, on any machine you like, since throwaway rolls guard nothing. Verify the rolls behind real money only on something you would trust with the seed itself, and the obvious candidate is the offline wallet those words are about to live in anyway. That wallet has to see the seed regardless, or it could never sign, so checking with it hands the seed to nobody new. What changes is this: two unrelated codebases must now derive the same words from your rolls, and a wrong seed requires both to fail identically. One box you must blindly trust becomes two boxes that must agree.
If the words do not match what the device showed you, it is lying, and you know inside a minute. That is the entire pitch. We are not asking you to trust us. We are asking you to check us, with tools we did not write, on a machine we have never touched.
And the whole thing is open source: firmware, hardware design, and the exact encoding of rolls into words, published before any device exists. The code that does the one job is public, so "what does it actually run" is a question anyone can answer without asking us.
Fifty rolls means fifty rolls. Two hundred and fifty-six flips means two hundred and fifty-six flips. The device knows how many bits your chosen source yields per throw, will not finish early, will not let you skip ahead, and shows every entry back to you before it hashes anything.
Mistyping roll 47 is the likeliest way a careful person ends up holding a seed they never intended, and it is the one failure in the dice ritual that gives you no error signal whatsoever. The words still look fine. They still pass the checksum. They are just somebody else's words.
The ritual
Set the switch to what is in your hand: a coin, a normal die, a twenty sided die, or a deck of cards. It tells you how many throws it needs and counts down. Ninety-nine rolls of a normal die makes twenty-four words. Two hundred and fifty-six coin flips makes the same.
It shows your full roll string, then your words. Copy both onto paper, and guard the rolls like the words, because anything that sees the rolls can rebuild the seed.
Practice rolls, check anywhere. Real rolls, check only on something offline you would trust with the seed, like the wallet the words are moving into anyway. Same words, or you throw the seed away.
The alternatives, treated fairly
| Property | Seed Entropy | Hardware wallet, out of the box | Hardware wallet, dice mode | Offline computer, seed tool | Pen and paper |
|---|---|---|---|---|---|
| You make the randomness | ✓ | ✗ A machine does | ✓ | ✓ | ✓ |
| Immune to hidden generator bugs | ✓ Nothing generates | ✗ Coldcard's ran five years, unnoticed | ✓ When you use it | ✓ | ✓ |
| Finishes a valid phrase | ✓ Checksum included | ✓ | ✓ | ✓ | ✗ Not without a day of doing SHA-256 by hand |
| Checkable on another machine | ✓ About a minute | ✗ No input to replay. You only ever saw output | ✓ If you kept your rolls | ✓ If you kept your rolls | ✗ Never gets that far |
| Holds no keys, signs nothing, takes no updates | ✓ | ✗ All three | ✗ All three | ✗ A whole computer | ✓ |
| All of its code readable by anyone | ✓ Published before hardware exists | Sometimes. Vendor by vendor | Sometimes. Vendor by vendor | ✓ The good tools publish it | ✓ There is no code at all |
| Counts your throws, catches slips | ✓ Refuses to finish early, undo key | Nothing to count | ✗ It counts, but you type digits and hope | ✗ One long text box. The counting is on you | ✗ You are the counter |
| Where it fails silently | Only in the gap before your first check, and you control the gap | Inside the chip, where you cannot look | The hash of your rolls, unless you verify | Anywhere in a million lines you never read | The count and the copy. The arithmetic at least fails loud: a slipped digit makes an invalid phrase |
The offline computer is a genuinely reasonable option, and the dice mode on a wallet you already own is better than not rolling at all. This table is not here to pretend otherwise. It is here to show which trust you are left holding in each case.
One distinction carries this whole row: the Coldcard bug was found because weak randomness is reproducible by strangers, who simply tried every possibility. Your dice rolls are reproducible only by someone who saw them land, never by a stranger computing from outside. The first is the disease. The second is the cure, and they are opposites, not variations.
What it is, and what it isn't
That is the product. Everything absent from this device is a thing that cannot fail in it.
| Entropy sources | Coins, six sided dice, twenty sided dice, playing cards. Chosen with a physical switch, not a menu |
|---|---|
| Randomness per throw | A coin flip carries 1 bit. A six sided die, 2.6. A twenty sided die, 4.3. A card drawn with replacement, deck reshuffled between draws, 5.7 |
| Output | BIP-39, 12 or 24 words |
| Convention | SHA-256 over concatenated digits, matching Coldcard and SeedSigner. Not Krux's dashed variant |
| Radios | none |
| Data ports | none |
| Power | Replaceable batteries behind the fastened back. No charging port, because a charging port is a hole with pins in it |
| Persistent storage | none, nothing survives power loss |
| Signing capability | none. No transaction signing, no key operations, no wallet code at all |
| Firmware | Open source, reproducible builds. Release signing keys published before any hardware ships |
| Display, enclosure | not decided |
| Price | not decided, nothing is tooled |
Published because a page arguing for verifiability should not hide its own gaps.
Objections
Yes. And you should weigh what that trust is actually worth, rather than treating all trust as equal.
The checksum is a pure function of entropy you already hold. It reveals nothing you did not already have, and it has exactly one failure mode: being wrong. Wrong is loud. Any wallet rejects an invalid phrase, and any second tool confirms a valid one in seconds.
Compare that to a device generating your randomness, where wrong is silent, produces output indistinguishable from correct, and stayed silent for five years and four months. We are not asking for more trust. We are asking you to move it to the one place where a lie gets caught immediately. Every setup has a trust boundary somewhere. This one moves it to a physical event you watched, plus one computation anyone can replay.
It would be the worst one ever built, and that is the design working. A scam device needs its lying to be invisible. A wallet that generates seeds from its own RNG is exactly that: predictable output looks identical to random output, there is no input to replay, and the honest accident version of that flaw ran for five years. That is the ideal architecture for shipping pwned seeds, and it is the default one.
This device is fully open source, publishes its only computation, and takes its only input from your hands. Every customer can replay it on any second tool, on day one, in about a minute. The first person who catches one lying unit ends the product permanently. Nobody builds a honeypot that every victim can cheaply falsify before funding it.
And notice where the objection leads: if "the vendor might ship malice" rules out a box that computes your checksum, it rules out the signing wallet computing the same checksum in the same invisible firmware, with your keys in the same enclosure. What genuinely remains is supply chain risk, which every hardware category carries, including wallets. It is first on our list of unsolved problems above, in writing.
You can, and if you already do it every single time, you may not need this at all. We would rather say that than pretend otherwise.
Two differences. Yours also holds keys, signs transactions, and accepts firmware updates, so its attack surface is everything this device deliberately does not have. And it treats dice as an optional path, which is why almost nobody walks it. Here there is no other path. Optional security features get skipped, and that is a design failure, not a character flaw in the people skipping them.
Somewhat, always. Bias costs you bits. A coin biased 75% yields about 0.81 bits per flip instead of a full bit, so 128 flips gets you roughly 104 bits, not 128. Correlation between throws, flipping the same way each time, does the same damage by another route.
At 99 rolls with casino dice the margin absorbs it comfortably. If your source is
genuinely suspect, use von Neumann whitening: flip twice, HT is heads,
TH is tails, discard matching pairs and repeat. Provably unbiased for any
fixed bias, at the cost of throwing away more than half your flips.
Yes, and it is a reasonable option that we are not going to talk you out of. An offline
copy of iancoleman.io/bip39 works.
You are then trusting a browser, an operating system, a disk that may page memory to swap, and a machine that has been on the internet at some point in its life. Our claim is a narrower surface, not that the alternative is worthless. Whichever one you pick, verify it against the other.
Nothing happens to your seed. It is twelve or twenty-four English words on paper and it works in every BIP-39 wallet, forever, whether we exist or not.
The device holds nothing, so there is nothing to lose. The firmware is open source, so anyone can build it. That is the quiet advantage of doing one job: there is no service to shut down, no server to go dark, and no account to lock.
No product, no price, no ship date. If the argument held up for the length of this page, the list is at the top.
Tell me when it ships