Is Your Bitcoin Safe? ColdCard's RNG Failure and How Not to Lose It All

Web3 Devs Underground - Emergency Session

🚨 Is Your Bitcoin Safe? ColdCard's RNG Failure and How Not to Lose It All

An emergency technical breakdown of the ColdCard RNG failure — what actually broke, and whether your coins are at risk.
~1,816 BTC (~$114M) has been swept from about 5,294 Bitcoin addresses as of 3 August, across four suspected waves. It is still climbing. The wallets were ColdCards.
Almost every headline calls this a breach. It wasn't. A March 2021 build-configuration error routed seed generation to a software PRNG instead of the hardware RNG. Seeds carried ~40 bits of entropy instead of 128. Attackers regenerated the keys offline — they never had to steal anything.
We called this session in 48 hours. One hour, three speakers, live Q&A.
About the event:
🎙 Brought to you by Web3 Devs Underground
Powered by Masterkey VC
📅 Wednesday, 5 August 2026 | 19:00 IDT 🇮🇱 | 18:00 CET | 12:00 EDT
📍 Live on X, YouTube & LinkedIn — online, free
⚠️ Not our usual 17:00 slot.
Format: an open panel, not a lecture. Three speakers in conversation, different views, and your questions put to them live by the moderator.
The Panel
🎤 Avishay Yanai , Co-Founder & CEO, Soda Labs — cryptographer, PhD Bar-Ilan, ex-VMware Research. On the cryptography: what 40 bits of entropy costs an attacker.
🎤 Boaz Bechar, Ex-Citi | Open Source Developer — on what code review misses, and what a treasury on affected devices does this week.
🎤 Shauli Rejwan, Managing Partner, Masterkey VC · Co-Founder, Web3 Devs Underground — on what changes for anyone shipping security-critical code.
Moderated by Amit Shilo, Community Manager.
What we'll argue about:
- Was this a hack, a bug, or negligence?
- Five years in a public repo — does "many eyes make bugs shallow" survive this?
- Does this prove self-custody doesn't work?
- Nobody tested that the RNG output came from the RNG. Tooling, culture, or incentives?
And early on, the practical part: a live decision tree so you can tell whether your own coins are at risk.
Agenda (Israel time):
19:00 - 19:04 | Opening remarks and how to ask questions
19:04 - 19:09 | Round 1: what actually happened — three views
19:09 - 19:16 | Are your coins at risk? Live decision tree
19:16 - 19:38 | Rounds 2 & 3: how it broke, and was it avoidable
19:38 - 19:48 | Round 4: what changes now
19:48 - 19:58 | Audience questions
19:58 - 20:00 | One takeaway from each speaker
No price talk. No wallet recommendations. No attribution guesswork. Zero shilling, as always.
About Our Sponsors:
Masterkey Venture Capital is a global early-stage fund investing in top-tier innovative deep tech and Web3 infrastructure projects. With strategic presence in key crypto hubs worldwide, the team leverages nearly 50 years of combined expertise in advanced infrastructure, cryptography, cybersecurity, and energy solutions.
Get Involved
Interested in Speaking or Sponsoring? Contact Amit Shilo at @Amit_Shilo (Telegram) or fill out the Speaker application form.
Founded by Shauli Rejwan and Roy Osherove.
Stay Connected
Website: web3devs.org · Linktree: linktr.ee/web3devsunderground
Twitter – https://x.com/Web3_Devs
YouTube – https://www.youtube.com/@web3devsunderground/streams
Calendar – https://luma.com/web3devs_underground
Register: https://lu.ma/web3devs_underground
See You There!