A self-contained guide for replacing a Coldcard-generated seed after the RNG vulnerability.
My heart goes out to everyone affected by this. This can be a difficult situation to work through. Stay calm, read through the process before starting, verify each step, and ask someone you trust for help if it starts to feel overwhelming.
The guide covers single-signature and m-of-n multisig wallets. It walks through assessing the affected seed, updating safely, creating fresh entropy on paper, rebuilding the wallet, testing recovery, and moving the funds.
The primary methods use coin flips or playing cards, pen, and printed worksheets. The included tools help calculate the final BIP-39 checksum word without generating entropy for you.
Checksum options include SeedSigner, Krux, Specter DIY, a standard-library Python script for a verified Tails session, and an updated Coldcard. Trezor recovery is included as a verification method, not as a missing-word calculator.
The guide keeps sensitive work offline and asks you to verify software, hashes, addresses, wallet policies, and backups before moving funds. It never asks for a seed phrase, passphrase, private key, descriptor, or wallet data.
The nsite is self-contained. It loads no third-party scripts, packages, fonts, analytics, storage, service worker, randomness API, or background network requests. External references open only when selected.
Firmware files are not redistributed. The guide links to official download and verification pages.
- 12-word and 24-word paper worksheets
- BIP-39 bit-to-word lookup book
- Official English BIP-39 word list
- Checksum-only Python tool
- SHA-256 manifest for every published file
Read the whole process before changing the device or moving funds.
Found something wrong, unclear, or missing? Open an issue and describe what should change. Pull requests are welcome for corrections, clearer instructions, accessibility improvements, and stronger tests.
Keep the published site self-contained and avoid new runtime dependencies. Never include real seed words, passphrases, private keys, wallet descriptors, or signer pairing data. Before opening a pull request, run the release checks and update dist/SHA256SUMS when a published file changes.