{"data":[{"id":"coldcard-firmware-rng-entropy-2026","service_slug":"coldcard","title":"Coldcard firmware generated wallet seeds with reduced randomness","type":"vulnerability","severity":"critical","status":"unpatched","corroboration":"confirmed","date":"2026-07-30","discovered_date":"2026-07-30","summary":"A 2021 firmware migration silently routed wallet-seed generation on Coldcard Mk2 and Mk3, and on pre-hotfix Mk4, Mk5 and Q devices, to a deterministic software fallback instead of the hardware random-number generator. Effective seed entropy fell to roughly 40-72 bits against a 128-bit target. Coinkite disclosed the defect on 2026-07-30 and shipped fixed firmware for every model and track the following day.","user_impact":"Fixed firmware stops new weak seeds but does not repair a seed already generated on vulnerable firmware. A user who generated a seed on an affected version must move funds to a newly generated seed unless that seed came from at least 50 independent dice rolls or sits behind a strong BIP-39 passphrase. Independent on-chain trackers report drained totals in the hundreds of millions of dollars across several waves beginning 2026-07-30; those totals are a disputed range, not one confirmed figure.","status_note":"Recorded as unpatched rather than resolved because the firmware defect is fixed while the seeds it produced are not. Unmigrated wallets remain exposed.","article_url":"https://cunicula.com/en/articles/coldcard-rng-entropy-incident-2026","service_url":"https://cunicula.com/en/provider/coldcard","incident_url":"https://cunicula.com/en/incidents#coldcard-firmware-rng-entropy-2026","sources":[{"label":"Coldcard Mk3 seed generation warning","url":"https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/","publisher":"Coinkite","date":"2026-07-30","basis":"primary"},{"label":"Entropy technical backgrounder","url":"https://blog.coinkite.com/entropy-technical-backgrounder/","publisher":"Coinkite","date":"2026-07-30","basis":"primary"},{"label":"Coldcard firmware changelog","url":"https://github.com/Coldcard/firmware/blob/master/releases/ChangeLog.md","publisher":"Coldcard","date":"2026-07-31","basis":"primary"},{"label":"Predictable RNG fallback and 32-bit reseed in Coldcard firmware","url":"https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware","publisher":"Block Engineering","date":"2026-07-30","basis":"independent-analysis"}],"reviewed_at":"2026-08-07"},{"id":"solvocard-card-program-ended-2026","service_slug":"solvocard","title":"SolvoCard ended its card program with refunds reported unpaid","type":"shutdown","severity":"high","status":"ongoing","corroboration":"reported","date":"2026-06-10","discovered_date":"2026-08-05","summary":"KYCnot.me records that SolvoCard's Mastercard program ended in June 2026. Its record describes multiple users waiting on balance refunds and states that the reviewer's own residual test balance was still unpaid at the last review.","user_impact":"A user holding a balance when the program ended may not be able to retrieve it. SolvoCard's public site carried no incident notice at the 2026-08-05 review, so a prospective user reading only the operator's own pages would not learn that the program had ended.","status_note":"Recorded as ongoing because no source read for this row shows the outstanding balances settled. Corroboration is reported, not confirmed: this rests on one reviewer's account, and searches for a second independent account returned nothing usable at the 2026-08-07 review.","article_url":null,"service_url":"https://cunicula.com/en/provider/solvocard","incident_url":"https://cunicula.com/en/incidents#solvocard-card-program-ended-2026","sources":[{"label":"KYCnot.me SolvoCard record","url":"https://kycnot.me/service/solvocardcom","publisher":"KYCnot.me","date":"2026-08-05","basis":"third-party-review"}],"reviewed_at":"2026-08-07"}],"meta":{"total":2,"api_version":"1.2","powered_by":"cunicula.com","documentation_url":"https://cunicula.com/en/api-docs","machine_index_url":"https://cunicula.com/llms.txt","filters":{},"counts":{"records":2,"confirmed":1,"reported":1,"ongoing":2,"services_affected":2},"definitions":{"type":{"breach":"Unauthorised access to systems or user data, confirmed by the operator or by a party who examined the evidence.","vulnerability":"A defect in a shipped product that exposes users to loss, whether or not it was exploited.","exit-scam":"An operator stopped honouring withdrawals or redemptions while continuing to hold user funds, with no credible wind-down.","seizure":"A state actor took control of infrastructure, funds, or domains.","policy-change":"A change in terms, KYC posture, or jurisdiction that materially alters what a user is exposed to.","shutdown":"The operator ended a product or the whole service, whether or not obligations were settled.","legal":"Charges, sanctions, injunctions, or a judgment against the operator."},"status":{"ongoing":"The exposure is still live for at least some users as of the review date on the record.","resolved":"The operator or an outside party closed the exposure and obligations were settled.","disputed":"The parties disagree on the facts and no record read for this row settles it.","unpatched":"A fix exists in principle but has not shipped, or shipped without repairing users already affected."},"corroboration":{"confirmed":"Three or more sources were read directly, at least one of them primary — the operator's own advisory, a court or government record, or the vendor's own repository. This is the bar an article must clear.","reported":"Fewer than three sources, or no primary source. The row is recorded because it bears on user risk, but it rests on what one party published and Cunicula has not independently confirmed it."}},"scope":"Dated security and solvency incidents affecting services in the Cunicula directory. Rows marked corroboration=reported rest on a single account and have not been independently confirmed; they are recorded because they bear on user risk, not because they are established. This endpoint covers incidents an editor reviewed and is not a census of everything that has happened to these services."}}