XRP Wallet Xaman Defends Security Amid $38M Losses Linked to Coldcard RNG Flaw

$XRP Ledger wallet Xaman has defended its key generation system amid flaws in Coldcard’s random number generation (RNG) system that caused about $38 million in losses.

Xaman founder Wietse Wind said the incident shows that labeling a wallet as “hardware” does not automatically make it secure. He argued that the method used to create private keys is just as important as the device itself.

According to Wind, a 2021 Coldcard code change replaced its hardware random number generator with a faulty software-based system. The issue went unnoticed for around five years. In other words, some users may have had wallets that appeared secure but were created using weaker randomness.

Hardware Wallet Security Depends on Seed Generation

Wind said many users misunderstand what hardware wallets actually protect. While these devices keep private keys and transactions isolated, their security ultimately depends on how the wallet seed is generated.

He explained that if the seed generation process is weak, other security features may not be enough. A device can remain offline and well-protected, but it is still vulnerable if its seed was created using poor randomness.

Xaman Uses Built-In Mobile Security for Random Number Generation

Wind said Xaman creates new $XRP Ledger accounts using the built-in cryptographic random number generators on Android and iOS.

Rather than relying on custom random number tools, Xaman obtains 128 bits of randomness directly from the phone’s operating system security features.

On iOS, Xaman uses SecRandomCopyBytes, which relies on Apple’s built-in random number systems and hardware security features. On Android, it uses SecureRandom, which depends on the device’s system randomness and hardware-backed security.

Wind also said Xaman blocks JavaScript-based random number generation in its React Native app to ensure that all randomness comes from the phone’s native security systems.

Founder Says Xaman’s Security System Has Remained Unchanged

Wind said older Android SecureRandom issues affected versions released before 2013 and do not apply to current devices supported by Xaman.

He explained that Xaman does not use custom cryptography or create its own random number systems. Instead, it relies on the same built-in security sources used by many banking apps and password managers.

Wind said the main question is not whether software or hardware wallets are safer, but rather how wallet randomness is generated and whether the process has been independently tested.

He added that Xaman’s system was audited years ago, continues to be tested regularly, and has remained unchanged since the original audit.