Galaxy Research: Coldcard Hackers Still Active, Steal Keys Generated with Dice

The persistence of this attacker underscores that hardware wallet security is not absolute, even when users layer on external entropy like dice rolls. The vulnerability likely lies not in the device itself but in the surrounding key-generation workflow, which broadens the attack surface beyond the hardware. This matters for anyone relying on self-custody, as it suggests operational discipline—how entropy is handled, where it is mixed—carries as much weight as the hardware choice. The open question is whether the attack vector is a systemic flaw in Coldcard's design or a targeted compromise of the entropy process, which would determine how users can adapt.