Coldcard Firmware: Source Code and Simulator for Bitcoin Hardware Wallets

RepositoryColdcard/firmwareTool

The Coldcard/firmware repository provides the firmware and simulator code for Coldcard Bitcoin hardware wallets (Mk3, Mk4, MK5, and Q1). It currently highlights a critical security advisory regarding degraded entropy during seed generation prior to July 2026.

Key points

  1. Firmware versions between 2021 and July 2026 contained a flaw leading to weak entropy generation.
  2. Users who generated secrets on a Coldcard during that timeframe must regenerate them and transfer funds on-chain immediately.
  3. Trusted master seeds require at minimum versions 5.6.0 (Mk4/MK5), 1.5.0Q (Q1), 4.2.0 (Mk3), or 6.6.0 (Edge Mk/Q).
  4. Reproducible builds powered by Docker allow users to independently verify that released binaries match the source code byte-for-byte.
  5. Development is split into 'master' for production releases and an 'edge' branch for rapid iteration on features like Taproot or Miniscript.

Why it matters

Hardware wallets are designed as the bedrock of secure cryptocurrency storage. Flaws in key generation directly compromise user funds, making deterministic builds and prompt disclosure vital for security verification.

Analysis

Targeted at Bitcoin users, developers, and security auditors, this project uses Python alongside STM32 build tooling. The codebase is mature and structured across shared architectures, offering automated reproducible builds. However, the multi-year entropy advisory underscores the subtle pitfalls in cryptographic hardware development, counterbalanced by Coinkite's explicit upgrade paths and public technical documentation.

Mentioned links

Found in

Summary generated by AI (Gemini 3.8 Flash, 27 September 2026). It may contain errors – the original source is authoritative.

Related entries

Similar in content, found by the AI search.

  • Article:Coinkite

    Coldcard Security Advisory: Firmware Bug Causes Weakened Seed Generation

    A firmware bug affecting Coinkite Coldcard devices (Mk2, Mk3, Mk4, Mk5, and Q) caused weakened seed generation, enabling attackers to reconstruct private keys offline and steal funds. Coinkite has released fixed firmware builds and advised users of affected seeds to migrate funds immediately.

    Security· Announcement

  • Link:CBC News

    Over $100M US in Bitcoin Stolen in Coldcard Hack

    According to a CBC News report citing blockchain intelligence firm Galaxy Research, hackers have drained over $100 million US worth of bitcoin from Coldcard hardware wallets.

    Security· News

  • Repository:affaan-m/agentshield

    AgentShield: Security Auditor for Claude Code and MCP Configurations

    AgentShield is an open-source TypeScript security scanner designed for AI agent setups. It inspects `.claude/` directories to detect hardcoded secrets, unverified MCP servers, hook injection vulnerabilities, and tool permission misconfigurations.

    1.2kstarsTypeScript

    AI & LLMs· Tool

Back to the knowledge base

Let's talk about your project

Get in touch

Locations

  • Mattersburg
    Johann Nepomuk Bergerstraße 7/2/14
    7210 Mattersburg, Austria
  • Vienna
    Ungargasse 64-66/3/404
    1030 Wien, Austria

Parts of this content were created with the assistance of AI.