Oct 19, 2026

Seed Sniping: The Skill Game Exploit You’re Missing

Seed Sniping: a hooded player reads a predictable seed and posts the winning tournament board

In skill gaming, everyone checks for bots, but they almost never check the seed.

That's a problem, because the seed decides what every player sees. If someone can predict the seed, they don't need a bot, they already know the board before the match starts.

This is called Seed Sniping. Here's how it works, why a vendor saying "we use a secure RNG" isn't enough, and what operators should ask before they put real money behind a tournament.

Same seed, fair fight?

In a skill game, the seed is the starting number that builds the match: the deck order in Solitaire, the bubble layout, the obstacle pattern. Give two players the same seed and they get the same board. The only thing left to separate them is skill.

That's the fairness promise of player-vs-player (PvP). It's also the reason the seed is worth attacking. One known seed is one known board, for every player in that match.

What Seed Sniping looks like

Seed Sniping is any attack that lets a player know the board before the match starts. The player doesn't break the game. They just play a match they've already solved.

The weak spots are usually boring:

  • Predictable inputs: A seed built from the clock, a match ID, or a user ID can be recalculated by anyone who knows the recipe.
  • Too few possibilities: If the generator only has a few billion starting states, a laptop can work through all of them. Every possible board becomes a lookup table.
  • Reused seeds: If boards repeat, a player who keeps a record will eventually see the same board twice, and play it perfectly the second time.
  • Early exposure: If the seed reaches the player's device before the match opens, it can be read out and fed to a solver.

The result is the same each time: a perfect score, posted at a believable speed, that looks like skill. Bot detection won't catch it, because a human pressed every button.

It's happened before

Seed Sniping isn't theoretical. Real-money games have been beaten this way for decades.

Planet Poker, 1999. A team at Reliable Software Technologies showed they could predict every card in an online poker deck. The shuffle was seeded from the server clock, counted in milliseconds since midnight. A real deck has about 2²²⁶ possible orders. The clock seed cut that to about 86 million, and syncing with the server's clock cut it to roughly 200,000. After seeing five cards, their two hole cards and the flop, they could find the exact shuffle in real time and knew every card still to come (Datamation).

Montreal Casino keno, 1994. A college student named Daniel Corriveau picked 19 of 20 keno numbers three times in a row and won $600,000. The casino closed every night and hadn't bought the clock chip that picks a fresh seed. So every morning the RNG restarted from the same seed and ran the same sequence. Investigators found no insider help. He'd spotted the pattern (Las Vegas Advisor).

One guessable seed. One reused seed. Same result both times: someone knew the outcome before the game started.

Coldcard: the right RNG on the chip, the wrong one in the code

It isn't just history. If you want proof that "we use a secure RNG" isn't the same as using one, look at the recent controversy with the Bitcoin hardware wallet, Coldcard.

Coldcard is built for people who take security seriously. The device’s entire job is to generate a random seed that nobody can guess. The device has a hardware random number generator on its chip, and seed generation was meant to use it.

It didn't. According to Block's engineering analysis, a build check tested whether a setting existed rather than whether it was switched on. Production boards had it switched off. So from firmware v4.0.0 in March 2021, seed generation quietly fell back to a predictable software generator. The build passed. Nothing looked wrong.

It stayed hidden for more than five years. On July 30th, 2026, attackers started sweeping wallets. They didn't hack a single device. They worked through the small set of possible starting states offline, rebuilt the wallet keys, and matched them against public addresses. BlockSec's write-up puts the verified losses at roughly 1,405 BTC, about $91 million, with other estimates running higher.

That's Seed Sniping at scale. Same pattern, different prize:

  • What the seed builds: Coldcard: A wallet's private keys. A skill game tournament: The board every player gets.
  • What was promised: Coldcard: Hardware randomness. A skill game tournament: A "secure" or "certified" RNG.
  • What went wrong: Coldcard: Code silently used a weaker generator. A skill game tournament: Seed built from guessable inputs, or too few states.
  • What the attacker does: Coldcard: Rebuilds keys offline, sweeps funds. A skill game tournament: Rebuilds the board offline, posts a perfect score.

The lesson isn't that Coldcard was careless. It's that a team focused on security, with the right hardware on the board, still shipped the wrong RNG for five years. The spec was right. The build wasn't.

Check the seed, not just the certificate

Bots get the headlines. Seed Sniping is quieter, and it pays out the same way: perfect scores and prize money going to the wrong player. Coldcard lost around $91 million to a seed nobody thought to check.

What this means for you

If your games provider isn’t prepared with an answer more than “we use a secure RNG”, it’s time to re-examine your onboarding strategy for skill games. While skill gaming is a compelling differentiator for any operator, it brings about new attack vectors not typically addressed outside of PvP, real money skill gaming.

Want to see how THNDR handles Seed Sniping and the other attacks that target skill game tournaments? Book a demo.

Sources

CEO and Co-founder

Des Dickerson