Coldcard’s 5-year flaw reveals hardware wallet testing gap: Kraken’s security chief
A long‑running flaw in Coldcard hardware wallet firmware has exposed a systemic gap in how devices used for custody are audited and tested, Kraken’s head of security said. The bug, present for five years, persisted because auditors verified that the intended random number generator (RNG) existed in the codebase but did not verify that it was actually being invoked at runtime.
How the flaw slipped past audits
The vulnerability highlights a difference between static verification — checking for the presence of security primitives in source code — and dynamic verification, which confirms that those primitives are executed correctly in deployed firmware. According to the security assessment highlighted by Kraken’s security chief, auditors confirmed the RNG implementation was present but did not validate that key operations called that RNG when generating private keys or seeds.
That gap can allow subtle logic or integration errors to neutralize otherwise secure components. In hardware wallets, whose core value proposition is offline key generation and storage, any failure in entropy sourcing or its invocation can undermine the device’s security guarantees without obvious signs to end users.
Why this matters for the crypto market
Hardware wallets are a cornerstone of self‑custody for retail holders and a component of multi‑layer custody models used by institutional players and exchanges. Questions about the robustness of audit processes can affect confidence in cold storage solutions and could lead market participants to reassess operational risk across custody chains.
For institutional actors — exchanges, custodians, prime brokers and asset managers — the incident underscores the need for deeper assurance practices. Where third‑party audits have been treated as sufficient evidence of device security, firms may now demand more comprehensive testing, including runtime and supply‑chain verification, before approving a wallet for enterprise use.
Implications for regulators, custody and market infrastructure
The discovery lends weight to calls for clearer standards and possibly certification regimes for hardware wallets used in institutional contexts. Regulators and standards bodies could push for minimum testing requirements that encompass both static code review and dynamic execution checks, firmware provenance verification and ongoing vulnerability disclosure processes.
Market infrastructure providers may respond by tightening onboarding policies for custody hardware, expanding independent validation steps, and increasing transparency about vendor testing. Exchanges and custodians that rely on hardware wallets as part of cold storage setups may initiate audits of devices in current use and require vendors to publish audit evidence that includes runtime checks.
Liquidity and asset markets for Bitcoin and other major tokens are sensitive to perceptions of custody risk. While there is no public indication that this specific Coldcard flaw led to thefts, even the potential for weakened key generation can influence institutional appetite for certain custody arrangements and could accelerate demand for alternative custody models that emphasize multi‑party computation or custodial services with audited end‑to‑end controls.
Market participants will be watching vendor disclosures, follow‑up audits and any industry guidance or regulatory responses. Key indicators to monitor include vendor firmware updates and changelogs, independent audit reports that show dynamic testing, statements from exchanges and custodians about device use policies, and any emerging standards or certification programs aimed at restoring confidence in cold storage practices.