Highlight

**Ledger Statement** Randomness Is the Foundation Cryptography is hard. Implementing it securely is harder. And the part almost nobody thinks about, generating high quality randomness, is where the whole thing lives or dies. This week's Coldcard incident made that visible in the most expensive way possible. What broke. Every private key you own derives from one number: the seed. If that number is predictable, everything derived from it is too. Coldcard's firmware was supposed to draw that seed from a dedicated hardware RNG. It didn't. A guard checked whether a config macro was defined, not whether it was enabled, so the build silently fell back to a software generator seeded from the chip's serial number and timer, values an attacker can reconstruct. Older devices were effectively deterministic; current ones were capped near 32 bits, about four billion possibilities. A seed space advertised as 128 bits collapsed to something you can enumerate. Researchers estimate more than 1,000 BTC drained from roughly 1,200 wallets, from a flaw sitting in public code since March 2021. The device never had to be touched. A bad RNG is silent. The output still looks random and passes casual inspection. You discover the problem when someone else does, on-chain, at 21:56 on a Thursday. That is why randomness cannot be a software convenience with a fallback path. It has to be engineered, measured, and certified as a first-class security function. How we do it at Ledger. We build on certified Secure Elements specifically to access the best cryptographic primitives, including a True hardware RNG. The TRNG is physics, not a formula: it leverages chaotic physical phenomena on silicon to produce genuine entropy, so there is no seed to guess. The Secure Element embeds hardware detectors that watch for malfunctions and manipulation, environmental sensors, active shielding, glitch and voltage detection. Extreme temperature, for instance, can degrade a noise source, so the hardware is built to catch that rather than quietly ship weak entropy. And raw entropy is never used directly: this low-throughput source is fed into cryptographic post-processing inside Ledger OS. Physics for the entropy, cryptography to condition it. The certifications, and what they mean. Claims are cheap. Certifications are third parties trying to break your claims. Our TRNG is evaluated under AIS-31 and certified PTG.2. AIS-31 is the German BSI methodology, used inside the Common Criteria scheme, that defines how to evaluate a true physical RNG, including a stochastic model of the noise source, not just tests on the output. The Secure Element carries Common Criteria certification at EAL5+ / EAL6+. And Ledger devices are certified under CSPN, ANSSI's first-level scheme, with random number generation quality explicitly in scope. The exact failure that hit Coldcard, "generating a biased or deterministic random number," is written down as Threat #1 in our published security targets, and the TRNG is the security function that answers it. On closed source, honestly. This part of Ledger OS is closed source. Access to this Secure Element technology comes with a hard vendor requirement that the low-level implementation stays closed. We love open source, but between the highest level of certified security and open source philosophy for this specific layer, we chose security, and I still think that was the right call. Closed source does not mean unaudited: our code goes through regular evaluation by multiple independent vendors and earns certification on a recurring basis. Security shall not rely on obscurity, that principle stands. But it is also true that closed source raises the cost of vulnerability research for an attacker. Both are true at once. A flaw sitting in public code for five years until an adversary reportedly used AI to find it is a reminder that "open" and "reviewed" are not the same word. That AI angle is not a footnote. Internally we make heavy use of LLMs to hunt for vulnerabilities in our own products, and it is genuinely effective (Read the excellent blogpost on the matter: https:// donjon.ledger.com/blog/ai-security-harness-cerberus/ ). The adversary is already doing this at machine speed. So do we, before they do. More on our approach soon. None of this makes us immune. It makes us measurable, monitored, and certified against exactly the class of failure that just played out. Cryptographic guarantees beat social trust, always. A seed you cannot predict beats a promise that it was random. Stay safe.