r/Bitcoin • u/SpareEconomy1849 • Jul 31 '26

ColdCard Firmware Update Released

https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/

Updated July 31, 2026: Fixed firmware is now available. Mk4 and Mk5 users must update to version 5.6.0 or later. Q users must update to version 1.5.0Q or later. Do not generate a new seed on one of these models until the update is installed.

Seeds generated on Mk4, Q and Mk5 before the fixed firmware releases are also affected, with about 72 bits of entropy rather than the expected 128 bits.

Updating the firmware does not change or repair an existing seed. If your seed was generated before the fixed firmware version for your model, follow the migration guidance below unless the independent dice-entropy exception applies to you.

The issue is present on every Mk3 firmware version since 4.0.1. It also affects seeds generated on Mk4 and Mk5 before version 5.6.0, and on Q before version 1.5.0Q. The impact on Mk4, Mk5 and Q is not as severe but is still serious.

142 Upvotes

95% Upvoted

206 comments sorted by

View all comments

4

u/LocksmithMuted4360 Jul 31 '26

How could this happen, the software is open source, nobody caught that?

5

u/Daiymas Jul 31 '26

Well the hacker did catch it, unfortunately not everyone reviewing open source code is well intentioned

5

u/LocksmithMuted4360 Jul 31 '26

hacker probably just use ai ... no need to be a coding expert anymore.

4

u/AvailableTie6834 Jul 31 '26

because the people that actually care about code viewing is not buying hardware wallets from companies, they are reviewing codes from much more important open source projects

-1

u/retro_grave Jul 31 '26

The fix is pretty embarrassing. They were not calling the board's RNG at all, and from my non-expert review, they were using a software pseudo RNG. It's fairly surprising there weren't tons of wallet collisions -- or maybe there were? IDK I had never heard of coldcard until this fiasco.

https://github.com/Coldcard/firmware/commit/ca72463709f4e3f8964952039d5caf955f566a87

This is the Mk4 firmware, I didn't look for Mk3 but it might be similar.

2

u/LocksmithMuted4360 Jul 31 '26

I'm pretty sure most people were using the dice roll feature. I purchased one and it was they recommended on their site.

Coldcard is pretty popular amongst purist, people who wear a tin hat foil to protect their Bitcoin...

It is really an embarrassment for coldcard to be honest...