A newly disclosed vulnerability that lingered undetected for five years in Coldcard's hardware wallets has exposed a critical blind spot in how security firms audit crypto storage devices, according to Kraken's chief security officer.
## What the Flaw Revealed The bug remained hidden for half a decade despite the device passing multiple security reviews. According to Kraken's security chief, the failure came down to a subtle but consequential oversight: auditors confirmed that the intended random number generator was present in the code, but never checked whether that generator was actually being invoked during operation.
Random number generation sits at the heart of a hardware wallet's security. When a device creates the private keys that control a user's funds, it relies on strong, unpredictable randomness. If that randomness is weak or if the proper generator is bypassed, the keys it produces can become far easier for an attacker to guess or reproduce.
Verifying that a security component exists is not the same as verifying that it actually runs.
## A Gap in Testing Methodology The episode highlights a distinction that is easy to overlook in code audits. Reviewers can confirm the presence of a secure function without confirming that the software's execution path ever reaches it. In this case, that gap allowed a serious weakness to survive years of scrutiny.
Kraken's security team framed the incident as a lesson for the broader hardware wallet industry, arguing that audits need to move beyond static inspection toward testing that validates real-world behavior. Confirming that the right code exists is only the first step; confirming it is executed as intended is what truly matters.
For users, hardware wallets remain among the most recommended tools for safeguarding cryptocurrency, since they keep private keys offline and away from internet-connected threats. But the Coldcard case is a reminder that even trusted cold storage solutions depend on rigorous, ongoing verification.
Key takeaways from the disclosure include:
- Security audits should test that critical functions actually run, not just that they are present.
- Random number generation is a foundational element of wallet security.
- Long-standing flaws can persist even in widely trusted devices.