Coldcard’s five-year seed-generation flaw has exposed a broader weakness in how hardware wallets are independently tested, according to Kraken chief security officer Nick Percoco. 

In an X post on Sunday, Percoco said the incident should be a “wake-up call” for hardware-wallet makers, calling for independent testing to verify that the approved source of randomness is the one actually used by production firmware. 

“Consumers are asked to trust a manufacturer’s implementation of the single most critical function in the system, with no independent verification that the approved entropy path is the one actually executing,” said Percoco. 

His comments follow an ongoing attack that is believed to exploit weak seed phrases generated by affected Coldcard devices. As of Sunday, over 4,500 addresses have been impacted, draining nearly $90 million in Bitcoin. 

Coldcard RNG flaw remained undetected for five years

On Thursday, Coinkite disclosed a software flaw that has existed since March 2021, when Coldcard changed its seed-generation process as it integrated a new cryptographic library. 

The migration inadvertently routed wallet creation to a weaker MicroPython generator that existed in the codebase, rather than Coldcard’s intended true random number generator (TRNG). 

“The bulk of randomness on the COLDCARD was coming from a PRNG that I didn’t know was actually in the source code base,” Coinkite said in its postmortem. “At the same time the carefully crafted TRNG code I wrote was being used, but just by chance, and only for less important things.”

The presence of the intended random number generator allowed the vulnerability to slip through undetected. Code reviews would confirm the existence and functioning of Coldcard’s TRNG code, but there was no check to ensure this was the RNG actually being called. 

Such checks are already standard across the rest of the security industry, said Percoco, referencing NIST SP 800-90B, a US government standard specifying requirements for designing, testing and validating physical true random number generators for cryptographic security and BSI AIS-31, a similar standard created by the German Federal Office for Information Security.

“Hardware wallets have no equivalent process. We have Common Criteria on secure elements, some CSPN certifications, and vendor-sponsored audits. None of them systematically force end-to-end verification that the validated entropy source is what production firmware actually calls,” he said. 

“The payments industry does not let PIN entry devices ship without independent lab testing. The US government does not accept cryptographic modules without entropy source validation. Digital asset self-custody should not be the exception,” said Percoco. 

Related: Suspected 4th Coldcard attack wave sweeps 389 Bitcoin: Galaxy’s Thorn

Coldcard said Sunday it has halted all device shipments since confirming the vulnerability on Thursday, and has destroyed all remaining units at its facilities containing the affected firmware. 

However, Coinkite has advised users with affected devices not to dispose of them as “it may become essential if funds are recovered.”

“Our legal team will coordinate as warranted with law enforcement across multiple jurisdictions to support efforts in identifying those responsible.” 

Related: Coldcard exploit sparks Bitcoin flight, ‘bullish’ crypto consolidation: Hodler’s Digest, August 2

Coldcard’s five-year seed-generation issue has turned into a wider debate over how hardware wallets are independently verified, according to Kraken’s chief security officer Nick Percoco. In an X post on Sunday, Percoco said the incident should prompt makers of self-custody devices to require end-to-end checks that confirm the randomness source reviewed in testing is the same one actually executed by production firmware.

The comments arrive amid an ongoing exploit believed to target vulnerable Coldcard devices by abusing weak seed phrases. By Sunday, more than 4,500 addresses had reportedly been affected, with losses estimated at nearly $90 million in Bitcoin, according to Cointelegraph’s reporting linked in the original article.

Key takeaways

• Kraken’s Nick Percoco argues hardware wallet certification should include verification that the approved entropy path is what production firmware uses in practice.
• Coldcard’s RNG-related flaw allegedly persisted for years after a seed-generation change introduced an unintended reliance on a weaker generator.
• Percoco cited existing standards used in the broader security and payments industries—such as NIST SP 800-90B and BSI AIS-31—as models for what should be standard for crypto self-custody.
• Coinkite says affected firmware has been halted in shipments and that remaining units containing the vulnerable code were destroyed, while it advised users not to discard certain devices.

A hardware wallet “wake-up call” for entropy verification

Percoco’s central point is about trust boundaries. Hardware wallet users are asked to rely on a manufacturer’s implementation of the randomness function that ultimately underpins seed phrase generation—yet, he said, there is often no independent method to confirm that the verified randomness source is the one the device will actually call in production.

“Consumers are asked to trust a manufacturer’s implementation of the single most critical function in the system, with no independent verification that the approved entropy path is the one actually executing,” Percoco wrote in his Sunday post.

He described this gap as an industry-wide weakness rather than a one-off mistake, noting that while some certifications exist for hardware components and secure elements, they do not “systematically force end-to-end verification” of the entropy source through to production code execution.

Percoco contrasted the crypto self-custody space with practices in other sectors. He pointed to the payments industry’s use of independent lab testing for devices that collect sensitive inputs, and to government expectations in the US around cryptographic module validation and entropy source testing.

How the Coldcard flaw allegedly slipped through

According to the original reporting, the vulnerability traces back to a software change disclosed by Coinkite. The company said the relevant issue has existed since March 2021, when Coldcard altered its seed-generation process as it integrated a new cryptographic library.

The update, per Coinkite’s postmortem referenced in the article, unintentionally routed wallet creation to a weaker MicroPython generator already present in the codebase. Coinkite’s explanation indicated that Coldcard’s intended true random number generator (TRNG) code existed and could be present and functioning, but was not reliably the one used for the core randomness needed for seeds.

In other words, reviewers could verify that the TRNG code was present and worked—but, without a mechanism to ensure the device actually called that TRNG during seed generation, the system could still produce outcomes derived from a different generator than intended.

The practical consequence is that seed phrases generated under the affected conditions may become more predictable than they should be. That predictive weakness is widely viewed by the security community as especially dangerous in wallet designs because compromised seeds can enable theft without needing to break keys directly.

Attack fallout and what’s changing for users

The ongoing exploit believed to target weak seed phrases generated by affected Coldcard devices has already resulted in extensive on-chain activity. As of Sunday, Cointelegraph’s figures cited in the original article reported over 4,500 impacted addresses and losses approaching $90 million in Bitcoin.

Coldcard (Coinkite) said it has halted all device shipments since confirming the vulnerability on Thursday. It also stated it destroyed remaining units at its facilities that contained the affected firmware.

At the same time, the company advised users with affected devices not to dispose of them immediately, saying doing so might become “essential if funds are recovered.” The company also indicated its legal team would coordinate with law enforcement across multiple jurisdictions to support efforts identifying those responsible.

For affected owners, the new information underscores a key operational point: device handling decisions may need to be aligned with recovery processes rather than treated as purely disposal or cleanup tasks. While that doesn’t eliminate the security risk of continuing exposure, it suggests an active incident-response posture where retaining evidence or workable hardware could matter.

Standards exist—what’s missing is enforcement

Percoco’s critique points to a tension that many investors and builders may recognize: crypto security often emphasizes reviewing code paths and cryptographic primitives, but not always the end-to-end behavior under production conditions—especially the specific entropy source used at runtime.

He referenced NIST SP 800-90B, which sets requirements for designing, testing and validating physical true random number generators for cryptographic security, and BSI AIS-31, a similar standard from Germany’s Federal Office for Information Security. In his view, such frameworks make it more difficult for systems to “pass review” without proving that the approved randomness pathway is actually used for critical operations.

Whether regulators and certifiers will adapt those expectations to consumer self-custody products remains uncertain. However, the Coldcard case demonstrates why the distinction matters: even when a correct TRNG implementation exists in the codebase, the seed-generation workflow can still be compromised if production firmware routes randomness differently than what independent review assumes.

Next, investors and users should watch for two things: clarification from Coinkite on exactly how to identify which devices/firmware are affected and what remediation steps best reduce future risk, and whether independent testers or certifiers move toward stronger “entropy source at runtime” validation—an area Percoco argues should not remain optional in digital asset custody.

South Korea saw 560.3 billion won ($367 million) in stablecoin outflows to overseas exchanges in June, extending the country’s streak of monthly net stablecoin outflows to 18 consecutive months. 

The figure comes from Financial Supervisory Service (FSS) data obtained by Yonhap News Agency through People Power Party lawmaker Lee Jong-wook. South Korea’s five major crypto exchanges — Upbit, Bithumb, Coinone, Korbit and Gopax — transferred 2.7 trillion won ($1.81 billion) in stablecoins offshore in June and received 2.2 trillion won ($1.44 billion) from foreign platforms.

Market participants cited by Yonhap attributed the transfers to demand for products restricted or unavailable on domestic exchanges, such as overseas derivatives, tokenized real-world assets (RWAs), decentralized finance and staking products. 

Lee has called on the government to reassess how it protects investors and supervises cross-border crypto activity as stablecoin outflows continue. “The government must comprehensively examine its investor protection and supervisory frameworks again and move swiftly to improve regulations,” he said, according to The Korea Times.

South Korea weighs tighter rules for offshore activity

The outflows come as South Korea works to complete a broader legal framework for digital assets. On Thursday, a policy report recommended that authorities introduce an interim licensing guidance and phase in stablecoin regulations before the Digital Asset Basic Act is finalized. 

The proposed act would create the country’s first comprehensive digital asset framework, including rules for stablecoin issuance, disclosures and market activity. However, lawmakers have yet to reconcile multiple proposals, with disagreements over which institutions should be allowed to issue won-pegged stablecoins contributing to delays. 

Related: South Korea plans stablecoin rules as opposition pushes crypto tax repeal

South Korean regulators have also sought to expand reporting requirements for crypto transfers. On June 22, South Korea’s Financial Intelligence Unit (FIU) proposed extending Travel Rule reporting requirements to transactions below 1 million won (about $650).

The FIU also called for stronger action against unregistered overseas exchanges serving South Koreans. The agency said uneven licensing and supervision across jurisdictions created opportunities for regulatory arbitrage, a concern underscored by the country’s continued stablecoin outflows.

Magazine: The real reason DeFi projects that survived 2022 crash are shutting down now

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

The CLARITY Act was absent from the U.S. Senate’s published schedule for Monday, Aug. 3, leaving lawmakers with only days to begin floor proceedings before the chamber’s summer break.

The official Monday schedule lists a 5:30 p.m. vote on cloture for the motion to proceed to H.R. 6500, a vehicle for a continuing resolution. It includes no scheduled action on H.R. 3633, the Digital Asset Market Clarity Act. The Senate’s cloture ledger, updated through July 31, also records the July 30 filing for H.R. 6500 but no CLARITY Act petition.

The absence does not formally block the crypto market-structure legislation. However, it leaves Senate leaders without a publicly confirmed vehicle or procedural timetable before the Senate begins its tentative state work period on Aug. 10. That break is scheduled to run through Sept. 11.

CLARITY Act Absent from Monday’s Senate Schedule, Facing a Critical 72-Hour Window Before Recess

Monday’s Senate schedule lists only a vote on a spending bill, with no action on the CLARITY Act. If an ordinary cloture motion is filed on Wednesday, Aug. 5, the Senate could hold a… pic.twitter.com/Y9J8Xd8WKT

— Wu Blockchain (@WuBlockchain) August 3, 2026

CLARITY Act needs a Wednesday filing for Friday action

Under the Senate’s ordinary Rule XXII process, a cloture petition requires 16 senators’ signatures. The cloture question is normally presented one hour after the Senate meets on the following calendar day but one. Therefore, a filing on Wednesday, Aug. 5, could produce a Friday, Aug. 7, vote, provided the Senate remains in session and meets that day.

That vote would not pass the CLARITY Act. It would determine whether the Senate ends debate on the motion to proceed to the legislation. Invoking cloture generally requires three-fifths of senators duly chosen and sworn, normally 60 votes when all seats are filled.

Even after successful cloture, Rule XXII permits up to 30 hours of consideration before the Senate votes on the underlying motion. Senators would then need to debate the bill, consider amendments and eventually vote on passage. A second cloture process could become necessary to end debate on the legislation itself.

Faster routes require bipartisan cooperation

Senate leaders could use a faster version of the cloture procedure, but it requires unusually broad cooperation. The petition must include the majority leader, minority leader, seven additional senators not affiliated with the majority and seven not affiliated with the minority.

Under that procedure, the cloture vote occurs one hour after the Senate meets on the next calendar day. If cloture succeeds, the Senate immediately votes on proceeding without further debate. The rule could shorten the timeline, but assembling the required bipartisan group would itself demonstrate that negotiators had made substantial progress.

A unanimous-consent agreement could compress the process further by setting debate limits and scheduling votes. However, any senator may object. No official filing or leadership notice reviewed for this update confirms that either expedited route has been secured.

Ascrypto.news previously reported, Sen. Cynthia Lummis said Majority Leader John Thune had maintained space for the legislation before the recess. Lummis nevertheless framed that outcome as her belief rather than a confirmed schedule, saying she believed Thune intended to proceed.

Seven Democratic votes remain the central barrier

Republicans control 53 Senate seats, so they would likely need at least seven Democrats to reach the ordinary 60-vote threshold if every Republican supported the motion.

Seven Democratic negotiators — Catherine Cortez Masto, Angela Alsobrooks, Cory Booker, Ruben Gallego, John Hickenlooper, Mark Warner and Raphael Warnock — said on July 22 that the Republican draft “falls short.” They called for stronger language covering ethics, consumer protection, illicit finance, conflicts of interest and market integrity, while saying negotiations would continue.

Senate Banking Committee ranking member Elizabeth Warren has taken a harder position. Warren called the updated legislation “dead on arrival” and argued that its ethics provisions would not adequately restrict President Donald Trump’s crypto interests. Those are Warren’s political and legal assessments, rather than findings by a court or independent regulator.

Meanwhile, Lummis released a merged proposal on July 22 combining work from the Senate Banking and Agriculture committees. She said lawmakers remained committed to reaching an agreement with Democrats. The Banking Committee had advanced its version by a 15–9 vote in May.

In related coverage, Sens. Thom Tillis and Ruben Gallego reportedly proposed letting state authorities enforce restrictions on federal officials issuing or sponsoring digital assets. The White House has not publicly approved final language, leaving the status of that compromise uncertain.

What happens next could shape the midterm fight

The next verified signal will be a cloture filing, leadership floor notice or unanimous-consent request identifying the legislative vehicle. An ordinary filing by Wednesday would keep a Friday procedural vote possible. A later filing would likely require an expedited agreement or additional Senate session days.

Even a successful Friday vote would only begin the process. The Senate could continue considering the bill after the recess, but lawmakers would return to a crowded September calendar. Any amended version must also return to the House, which passed H.R. 3633 by 294–134 in July 2025. The House vote included support from 78 Democrats.

The shrinking window also carries an electoral dimension. A procedural vote would force senators to create a public record before the 2026 midterms. Without one, campaigns and crypto political groups have less evidence for judging whether lawmakers supported advancing the bill.

Axios reported that more than $125 million in crypto-linked political funds remained available as negotiations continued. Separate groups had already announced $1.5 million in advertising supporting Republican Senate candidates in Michigan and Iowa. Fairshake remained neutral during the negotiations, while some Republican operatives wanted the Senate to force a vote and place Democrats on record.

That pressure does not determine the bill’s outcome. However, missing the pre-recess window would move the debate closer to the election, when campaign spending, vulnerable Senate seats and party control could become more closely tied to the legislation’s remaining path.