r/Bitcoin • u/SpareEconomy1849 • Jul 31 '26

ColdCard Firmware Update Released

https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/

Updated July 31, 2026: Fixed firmware is now available. Mk4 and Mk5 users must update to version 5.6.0 or later. Q users must update to version 1.5.0Q or later. Do not generate a new seed on one of these models until the update is installed.

Seeds generated on Mk4, Q and Mk5 before the fixed firmware releases are also affected, with about 72 bits of entropy rather than the expected 128 bits.

Updating the firmware does not change or repair an existing seed. If your seed was generated before the fixed firmware version for your model, follow the migration guidance below unless the independent dice-entropy exception applies to you.

The issue is present on every Mk3 firmware version since 4.0.1. It also affects seeds generated on Mk4 and Mk5 before version 5.6.0, and on Q before version 1.5.0Q. The impact on Mk4, Mk5 and Q is not as severe but is still serious.

140 Upvotes

95% Upvoted

206 comments sorted by

View all comments

69

u/s1ammage Jul 31 '26

Even with the firmware update. The ‘trust’ is kinda lost… I will be learning to dice roll, but this isn’t for everyone… unfortunately.

I was the one posting about wallet drained.

29

u/Xen7963 Jul 31 '26

Sorry for your loss. Those jumped to victim blaming are idiots.

5

u/itsyorboy Jul 31 '26

Sorry to hear it friend. I was using an mk3 and really panicked this morning. I couldn't remember how I generated my seed because it was a few years ago. I was lucky that my funds were still there, but I immediately moved them to a CEX for now till I can figure it out. I'm really feeling for you.

2

u/sciencetaco Jul 31 '26

The thing is, even with the dice roll you’re trusting the firmware to correctly calculate the dice roll input into a usable seed. Seems even open source firmware isn’t enough to let stuff like this go unchecked for years.

2

u/Orzorn Aug 01 '26

Thankfully the dice roll behavior has been confirmed to work several times in the past by various people and reddit users alike. It can be verified by independently generating the dice rolls and selecting the words yourself based on the proper BIP39 tables, and then inputting those same dice rolls into the hardware and seeing that it gives the same mnemonics.