TL;DR: Nearly every hardware wallet answers "is your randomness good?" by naming a certified chip. A certificate describes silicon in a lab, not the wallet on your desk, and the Coldcard failure happened entirely in the gap between the two. So we put our own shipping device
Evaluating Two Hardware True-Random Sources in an Air-Gapped Wallet A NIST SP 800-90B / SP 800-22 / AIS-31 / PractRand assessment of the STM32H753 RNG and ATECC608C secure element, with cold-boot restart forensics Motivated by the July 2026 Coldcard incident. The ERA hardware wallet has two independent
TL;DR: Weak randomness just cost Coldcard users $89M, silently. ERA builds your seed from up to five independent sources: two verified hardware generators (an STM32 TRNG and a NIST-certified secure element) always, plus your camera, your hand motion, and your touch if you choose the expert flow. Every
Coinspect published something unusual in July: a public tool that lets anyone check whether their own wallet is already compromised. The firm calls the underlying flaw Ill Bloom. As of June 30, its dataset held 2,114 exposed addresses across Bitcoin, Ethereum, Tron, Rootstock, and Polygon, and that figure only
Every hardware wallet requires you to trust something. * Trust that no one modified the firmware during manufacturing. * Trust that your private keys were generated correctly. * Trust that the "clear signing" screen is actually showing what you are about to approve. * Trust that the connection to your phone is
If you've ever shopped for a hardware wallet, you've seen it: "Secure Element, EAL6+ Certified" On the box, on the website, in a comparison table where the competitor with EAL5+ looks like a budget option. Most buyers read this as "military-grade protection&
