| What the page said | What was true by August 2026 |
|---|---|
| Use Whirlpool through Sparrow Wallet | US authorities seized Samourai Wallet's coordinator in April 2024, and Sparrow removed its Whirlpool integration in June 2024 |
| Wasabi charges a 0.3% coordinator fee | zkSNACKs shut down its coordinator in June 2024; Wasabi now connects to independent coordinators, and since version 2.2 has no built-in coordinator fee |
| JoinMarket, linked to its original repository | That repository was archived in April 2026; development continues as JoinMarket NG |
2024 showed what coordinator risk means in practice: the day Samourai's servers were seized, every Whirlpool user stopped mixing. JoinMarket NG is a peer-to-peer market with no company in the middle, so there is nothing to seize. It requires your own Bitcoin node, which the rest of this site already recommends, and Jam makes it usable without the command line.
The other tools are still covered. Wasabi is the simpler alternative. Ashigaru, a community fork of Samourai, launched a new Whirlpool coordinator in June 2025; we describe it without recommending it.
The CoinJoin page explains how mixing works, what it protects and what it does not, and compares the tools. The tutorial is the procedure: your own node, a temporary hot wallet protected by a passphrase, JoinMarket NG and Jam, and sweeping the mixed coins out to cold storage when you are done. A reader who only wants to understand CoinJoin no longer has to scroll past installation steps, and a reader following the steps no longer has to skip the theory.
]]>Between 30 July and 4 August 2026, attackers drained about 1,816 BTC from more than 5,200 addresses whose seeds had been generated on Coldcards. A firmware build error present since March 2021 had made the devices generate seeds from a predictable software generator instead of their hardware random number generator. The incident page has the timeline, the cause, and what to do if a Coldcard made your seed; this note covers only what the incident changed here.
| Before 21 August 2026 | After |
|---|---|
| Coldcard was the security pick on the comparison and in the setup chooser | Listed with a warning, in no recommendation slot |
| A seed generated by the device was the default; dice were an extra for the careful | Dice first; the device's random number generator is the fallback |
| "Air-gapped" and "open source" read as guarantees | Both carry their limits: the drained devices were air-gapped, and the bug sat in public code for five years |
| The comparison listed the 2024 lineup | Redone for the August 2026 lineup, with three new criteria: dice entropy, whether the entropy can be verified, and how the vendor handled a crisis |
Sixteen other pages that pointed at Coldcard or the old lineup were updated the same day, and each now links to the incident page rather than retelling it.
Every hardware wallet maker ships bugs, and Coinkite shipped fixed firmware the day after the first theft. The decision rests on two other facts. The flaw silently produced weak seeds for five years in a device whose reputation rested on security, and a developer had warned Coinkite about that code in May 2025 and been dismissed. Recommending a device is a claim that its maker can be trusted with the one step nobody else can check, seed generation, and as of October 2026 we cannot make that claim for Coldcard.
The change that matters most is the second row of the table. A seed made from dice you rolled yourself does not depend on any manufacturer's random number generator, which is why Coldcard seeds made with the dice option were not affected. The dice seed guide shows how to make one, and the comparison shows which devices let you add your own dice rolls.
]]>| Device | Your own dice entropy |
|---|---|
| Keystone 3 Pro | Dice rolls on the device, firmware 1.2.6 or later |
| SeedSigner and Krux | Dice rolls on the device |
| BitBox02 | BitBox's own diceware procedure: dice pick the words from a printed table, and the device offers valid last words |
| Passport Prime | Draw the words yourself and import them, as Foundation's documentation describes |
| Trezor Safe 5 and 7 | No dice entry. Make the seed with dice and restore it. Trezor said on 5 August 2026 that it is considering user-supplied entropy, without committing to it |
| Jade and Jade Plus | Blockstream's own dice methods: dice pick the words from its table, and the device calculates valid last words. By default the Jade also mixes several entropy sources |
We found the error while researching device setup guides, by reading each maker's documentation rather than our own earlier summary of it.
The hardware wallet comparison now says, for each device, whether dice go in on the device, through a maker's procedure, or by restoring a seed you made, and its entropy table says how you can check each. The dice guide, the hardware wallet setup guide, hardware wallets explained and the multisig hardware setup say the same.
If you set up a Trezor or a Jade looking for a dice option on the device and did not find one, the device generated the seed itself from its own sources. Neither maker's generator is known to be flawed, and both said in August 2026 that their devices were not affected by the Coldcard bug. If you want the seed to rest on your own dice instead, make one with dice (on a Jade, Blockstream's dice method does the same and the device supplies the last word), restore it onto the device as a new wallet, test it with backup verification, and then move the funds across.
]]>All 97 pages were edited for facts and for voice.
On facts, claims that go out of date now carry the date they were checked: prices, firmware versions, release numbers and recommendations. Pages that had drifted were corrected. The firmware pages, for example, said Libreboot removes the Intel Management Engine; on the ThinkPads they cover it neutralises it, which is different, and the Libreboot guide now follows the current release.
On voice, the pages had collected filler: boxes listing what you were about to learn, summary sections that repeated the page, emoji in headings, and bold at the start of every bullet. That is gone, and the build now fails if it comes back. Each page opens with the answer to the question in its title, and its headings are the questions people ask.
Hands-on guides now show a facts line under the opening paragraph: time, cost, difficulty and when the guide last changed, plus the date we last re-checked it against current sources where we have. A guide is marked verified only when we have done it on real hardware.
The design follows our own diagrams and preview cards: dark paper, hairline rules, monospaced labels, amber only for the thing being explained, and photographs of the actual hardware. Pages print cleanly, with every collapsed section opened, so the dice and multisig guides can be worked from on paper, away from a computer.
Yes. Search now uses Pagefind, which loads a few small pieces of the index for each search instead of one 3.4 MB file, and your query never leaves the browser. The site's fonts now load, from this domain, photographs are resized and stripped of camera metadata, and the interface libraries the old homepage needed are gone.
The positions on the about page are the same, and so is the independence: no affiliate links, no sponsors, and no money from the companies we write about. These field notes are new: dated posts about changes like this one, with an RSS feed.
]]>