Firmware Is Not Seed Provenance

A hardware wallet can run current firmware while protecting a seed that was created under old, flawed conditions. That distinction matters because firmware can change future behavior, but it cannot change the entropy already embedded in an existing seed.

The recent COLDCARD seed-generation advisory makes the point concrete. Coinkite says affected releases used a flawed generation path and that fixed firmware is now available across supported models and release tracks. The advisory is equally clear about the limit of the fix: updating a device does not repair a seed that was already generated on affected firmware.

Block's independent source analysis explains why. Its researchers found an RNG integration error that caused a deterministic software fallback to be used instead of the intended STM32 hardware RNG. On later devices, secure-element input reached the fallback through a reseed that retained only 32 bits. Block described a ceiling of 2³² securely distinguished output streams for a fixed fallback state and call history, while also stating that it had not completed full empirical exploitability testing for every device and workflow.

Those details matter, but the broader custody lesson is simpler. The security state of a Bitcoin key depends on the ceremony that created it, not only the device that holds it today.

What seed provenance means

Seed provenance is a record of how a key came into existence. It should answer:

• Which device or software created the seed?
• Which firmware or software version was running at that time?
• Was independent entropy added, and by what method?
• Was a passphrase used, and is its recovery process tested?
• Which wallet descriptor, accounts, and fingerprints belong to the seed?
• When was recovery last rehearsed?

This record must never contain the seed words, passphrase, private keys, dice sequence, or other secret material. Provenance is operational metadata, not a backup.

Without that record, a patched device can create false confidence. The screen may show the current release even though the wallet's keys were generated years earlier. Restoring the same affected seed onto new hardware also carries the original weakness forward.

Updating and migrating are different actions

An update replaces software. A migration replaces keys.

Coinkite's current guidance identifies fixed versions by model and release track and directs affected users to create a replacement seed only after installing fixed firmware. Its migration sequence includes verifying the new backup, confirming a receive address on the device, sending a small test transaction, and moving the remaining funds only after the new wallet works as expected.

The advisory also describes a limited exception for affected seeds that received enough fair, independent, private dice entropy during generation. Users who cannot verify the exact conditions should not reconstruct or guess what happened. They should follow the vendor's migration guidance.

A strong, unique BIP-39 passphrase can add a barrier, but it does not repair an affected seed. It also creates its own recovery obligation. A lost or mistyped passphrase is a different failure mode, so any passphrase policy needs a tested backup process.

Multisig does not automatically remove correlated risk

Multisig can reduce dependence on one key, but only when a secure quorum remains.

Three devices from the same vendor, using the same generation path and maintained through the same process, may look redundant while sharing a common failure. Real diversity means examining implementation, vendor, entropy source, firmware history, storage location, operator, and recovery process.

The right question is not, "How many signers do I have?" It is, "How many independent failure domains must break before funds can move?"

A better custody review

A useful custody review should inventory every key by provenance, then evaluate the wallet as a system.

For each key, record the public fingerprint, device or software, version at generation, generation date if known, entropy method, passphrase policy, backup locations, and last recovery test. For the wallet, record the descriptor, quorum, signer diversity, geographic separation, inheritance path, and migration procedure.

If a material fact cannot be verified, write NOT FOUND. Uncertainty is part of the threat model. It should not be replaced with a reassuring assumption.

The COLDCARD issue is not evidence that self-custody is futile or that one competing brand is automatically safe. It is evidence that custody cannot be reduced to buying a device and installing updates. Hardware, firmware, entropy, backups, descriptors, and operating procedures all contribute to the result.

Current firmware is still important. It is just not the same thing as seed provenance.