Coldcard's Keygen Flaw: Your 'Offline' Wallet Wasn't Quite Offline

The whole selling point of a hardware wallet is the word cold. Your keys live on the device, not on a machine that touches the internet. Air-gapped. Safe. Theoretically.

What's happening//

According to CySecurity News, there's an ongoing attack exploiting a key-generation flaw in Coldcard hardware wallets. The framing that matters: it's a software flaw in the keygen process, not a supply-chain hit, not a stolen seed phrase, not a compromised USB cable. The math that's supposed to make your keys yours is doing something slightly off.

That's the kind of bug that makes "cold storage" feel like a load-bearing adjective.

Why it stings//

1. Coldcards are a tier-1 wallet. They're not a $20 novelty — they're the device people pick when they've decided they're serious about self-custody. A flaw in a flagship is more embarrassing than a flaw in a white-label.
2. "Ongoing" means active. This isn't "theoretically exploitable." Someone is exploiting it right now, and "active exploitation" is the only label that should make you check your setup tonight.
3. Keygen flaws are sneaky. A stolen seed phrase is a loud failure — you know something was touched. A keygen flaw means the keys you generated on the device might not have been the keys you think they were. The wallet works, the PIN works, the screen looks right. Nothing screams.

What to actually do//

• Read the Coldcard advisory and check your firmware version.
• If you're running a Coldcard as primary cold storage, consider what "rotated" looks like for you — a fresh device, a fresh seed, and a decision about how much to move.
• If you're selling crypto for $10 scripts (see: homelab, us), this is an argument for not putting meaningful funds on one hardware wallet. Diversity is a security property, not just a portfolio one.

The lesson for this site's readers//

"Air-gapped" has always been a slightly comforting word. It means your key material doesn't touch the network — but key material is generated by code. And code runs on hardware, and code has bugs, and "offline" has never actually meant "uncomputable." The gap between the marketing word and the math is where these flaws live.