⚠️ Trezor warns that weak wallet randomness can compromise any hardware wallet Trezor CTO Tomas Susanka addressed the recent Coldcard security incident that led to the theft of at least 594 bitcoin:native, worth approximately $38 million, from around 500 wallets, highlighting a fundamental principle behind hardware wallet security: entropy. Susanka explained that the generation of secure randomness is the foundation of any hardware wallet. If the process of creating seed phrases fails, other protections become irrelevant. “Get it wrong and nothing else matters. Not the secure element, not the air-gap, not the metal backup,” Susanka stated, emphasizing that predictable seed generation can allow attackers to reconstruct private keys remotely without physical access to the device. The Coldcard vulnerability was linked to a firmware issue affecting certain devices, where a predictable software-based randomness source replaced the expected hardware entropy generation mechanism. This allowed attackers to guess wallet seeds and drain funds in a short period of time. The incident highlights one of the biggest risks in self-custody: security depends not only on hardware design, but also on the integrity of the processes used to generate and protect private keys. Trezor pointed to its own approach of combining multiple entropy sources between the device and host systems as a measure designed to reduce the risk of similar failures. The case serves as a reminder that even advanced hardware wallets can be vulnerable when a critical security layer fails at the foundation.