Coldcard Security Advisory: Firmware Bug Causes Weakened Seed Generation

ArticleCoinkiteAnnouncement

A firmware bug affecting Coinkite Coldcard devices (Mk2, Mk3, Mk4, Mk5, and Q) caused weakened seed generation, enabling attackers to reconstruct private keys offline and steal funds. Coinkite has released fixed firmware builds and advised users of affected seeds to migrate funds immediately.

Key points

  1. Affected models include Mk2 and Mk3 (firmware 4.0.1 through 4.1.9) as well as Mk4, Mk5, and Q prior to fixed releases (generating around 72 bits of entropy instead of 128).
  2. Devices were not remotely hacked or accessed; attackers exploited the weak seeds offline by regenerating corresponding keys.
  3. Updating firmware does not repair an already compromised seed; funds must be migrated to a newly generated seed.
  4. Wallets are not considered at risk from this RNG issue if created with at least 50 private, independent dice rolls, or if protected by a strong, unique BIP-39 passphrase.
  5. TAPSIGNER, OPENDIME, and SATSCARD use different codebases and are not affected.
  6. Fixed versions are Mk2/Mk3 4.2.0+, Mk4/Mk5 standard 5.6.0+ / Edge 6.6.0X+, and Q standard 1.5.0Q+ / Edge 6.6.0QX+.

Why it matters

Hardware wallets are designed as the most secure solution for self-custody. A flaw in random number generation undermines the cryptographic foundation, making key theft possible entirely offline without physical device access.

Analysis

The advisory clarifies the difference between device tampering and algorithmic generation flaws. Crucially for users, firmware updates alone leave existing funds exposed. Coinkite provides migration protocols, highlighting that manual dice rolls bypass reliance on the device RNG, though executing migrations safely requires diligence to avoid user error.

Mentioned links

Found in

Summary generated by AI (Gemini 3.8 Flash, 27 September 2026). It may contain errors – the original source is authoritative.

Related entries

Similar in content, found by the AI search.

  • Repository:Coldcard/firmware

    Coldcard Firmware: Source Code and Simulator for Bitcoin Hardware Wallets

    The Coldcard/firmware repository provides the firmware and simulator code for Coldcard Bitcoin hardware wallets (Mk3, Mk4, MK5, and Q1). It currently highlights a critical security advisory regarding degraded entropy during seed generation prior to July 2026.

    773starsPython

    Security· Tool

  • Link:CBC News

    Over $100M US in Bitcoin Stolen in Coldcard Hack

    According to a CBC News report citing blockchain intelligence firm Galaxy Research, hackers have drained over $100 million US worth of bitcoin from Coldcard hardware wallets.

    Security· News

  • Article:Ryan Babbush, Adam Zalcman, Craig Gidney, Michael Broughton, Tanuj Khattar, Hartmut Neven, Thiago Bergamaschi, Justin Drake, Dan Boneh

    Quantum Vulnerabilities in Cryptocurrencies: Resource Estimates and Mitigations

    A research team including Ryan Babbush, Justin Drake, and Dan Boneh presents updated resource estimates for breaking 256-bit elliptic curve cryptography on quantum hardware. Shor's algorithm can solve the 256-bit Elliptic Curve Discrete Logarithm Problem using <1200 logical qubits and <90 million Toffoli gates, or <1450 logical qubits and <70 million Toffoli gates. On superconducting architectures, this could execute in minutes using fewer than 500,000 physical qubits.

    Security· Research

  • Link:CISA, NSA, FBI, DOE, EPA

    CISA and US Agencies Warn of Active Exploitation Targeting Siemens S7 PLCs

    US security agencies have issued an advisory regarding an active threat to Siemens S7 programmable logic controllers (PLCs). Threat actors are deploying AI-generated scripts disguised as legitimate monitoring tools to target exposed industrial systems.

    AI & LLMs· Announcement

Back to the knowledge base

Let's talk about your project

Get in touch

Locations

  • Mattersburg
    Johann Nepomuk Bergerstraße 7/2/14
    7210 Mattersburg, Austria
  • Vienna
    Ungargasse 64-66/3/404
    1030 Wien, Austria

Parts of this content were created with the assistance of AI.