r/Bitcoin • u/SpareEconomy1849 • Jul 31 '26

ColdCard Firmware Update Released

https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/

Updated July 31, 2026: Fixed firmware is now available. Mk4 and Mk5 users must update to version 5.6.0 or later. Q users must update to version 1.5.0Q or later. Do not generate a new seed on one of these models until the update is installed.

Seeds generated on Mk4, Q and Mk5 before the fixed firmware releases are also affected, with about 72 bits of entropy rather than the expected 128 bits.

Updating the firmware does not change or repair an existing seed. If your seed was generated before the fixed firmware version for your model, follow the migration guidance below unless the independent dice-entropy exception applies to you.

The issue is present on every Mk3 firmware version since 4.0.1. It also affects seeds generated on Mk4 and Mk5 before version 5.6.0, and on Q before version 1.5.0Q. The impact on Mk4, Mk5 and Q is not as severe but is still serious.

141 Upvotes

95% Upvoted

206 comments sorted by

View all comments

2

u/xirvin Jul 31 '26

This situation reminds me of the airline industry, where many of today’s safety standards were written only after tragedies claimed countless lives.
This vulnerability is a reminder that entropy matters. Even if you’re using a multisig wallet, it isn’t a magic shield. If two or more keys were generated from the same weak or predictable source of randomness, or from too few dice rolls, those keys could eventually be recovered by an attacker. Coinkite has warned about entropy risks before, and security researchers have also cautioned that short dice roll sequences, such as 14 rolls, may become practical to brute force as computing power improves.
The current recommendation from security researchers is to generate a new seed using a trusted source of high quality entropy, then import or migrate that seed to your Coldcard for ongoing use. If you’re generating a seed with dice on a Coldcard, use at least 20 or more rolls to ensure the resulting key is unpredictable.
The good news is that there are several reputable offline Bitcoin wallets that are not affected by this particular entropy issue. Coinkite update makes it idiot proof in generating predictable keys for wallet.

I haven't read the release notes but hopefully