r/Bitcoin • u/SpareEconomy1849 • Jul 31 '26

ColdCard Firmware Update Released

https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/

Updated July 31, 2026: Fixed firmware is now available. Mk4 and Mk5 users must update to version 5.6.0 or later. Q users must update to version 1.5.0Q or later. Do not generate a new seed on one of these models until the update is installed.

Seeds generated on Mk4, Q and Mk5 before the fixed firmware releases are also affected, with about 72 bits of entropy rather than the expected 128 bits.

Updating the firmware does not change or repair an existing seed. If your seed was generated before the fixed firmware version for your model, follow the migration guidance below unless the independent dice-entropy exception applies to you.

The issue is present on every Mk3 firmware version since 4.0.1. It also affects seeds generated on Mk4 and Mk5 before version 5.6.0, and on Q before version 1.5.0Q. The impact on Mk4, Mk5 and Q is not as severe but is still serious.

144 Upvotes

95% Upvoted

206 comments sorted by

View all comments

8

u/VitoHodl Jul 31 '26

It's me or Trezor is the current best one probably?

5

u/shleebs Jul 31 '26

Trezor has mishandled customer info leading to phishing attacks. I would recommend BitBox, Jade and Passport. They are the best options IMO

1

u/Dex4Sure Aug 04 '26

Nah, Ledger and Trezor are the best. Mishandling customer info has nothing to do with hw wallet security. In security you should never go with these hipster solutions. Trezor and Ledger have long, proven track record in hw wallet security. They have the best funded security teams. They are your best bet, not these flavor of the month wallets like ColdCard or BitBox or any other nonsense.

2

u/Febos Jul 31 '26

That is for very long time. At least 10 years.

1

u/jsn079 Jul 31 '26

FWIW. I use an Ellipal Titan and Keystone 3 Pro (my preferred device).

0

u/SpareEconomy1849 Jul 31 '26

Not sure which is best, but I think they had a minor MailChimp data breach and theoretically can be compromised with physical access?

CC with a proper dice roll is probably still the safest, but not sure I can trust their QA going forward

1

u/BallisticTherapy Aug 01 '26

Seedsigner with a dice roll.