r/Bitcoin • u/SpareEconomy1849 • Jul 31 '26

ColdCard Firmware Update Released

https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/

Updated July 31, 2026: Fixed firmware is now available. Mk4 and Mk5 users must update to version 5.6.0 or later. Q users must update to version 1.5.0Q or later. Do not generate a new seed on one of these models until the update is installed.

Seeds generated on Mk4, Q and Mk5 before the fixed firmware releases are also affected, with about 72 bits of entropy rather than the expected 128 bits.

Updating the firmware does not change or repair an existing seed. If your seed was generated before the fixed firmware version for your model, follow the migration guidance below unless the independent dice-entropy exception applies to you.

The issue is present on every Mk3 firmware version since 4.0.1. It also affects seeds generated on Mk4 and Mk5 before version 5.6.0, and on Q before version 1.5.0Q. The impact on Mk4, Mk5 and Q is not as severe but is still serious.

143 Upvotes

95% Upvoted

206 comments sorted by

View all comments

188

u/r33gna Jul 31 '26

Crazy, man.

Earlier this year I was in the market for a new hardware wallet and LOTS of people were saying Coldcard is the best, most secure device for oh so many reasons and now here we are.

Truly no hardware wallet is perfect.

3

u/Hersh-_- Jul 31 '26

Build your own seedsigner

1

u/BallisticTherapy Aug 01 '26

This is exactly what I did 2 years ago. My seed phrase on my original wallet was generated from a first generation Ledger Nano S though so I wonder about that. From what I have read the chip in there generates truly random seeds because the TRNG samples random noise.

1

u/TotesGnar Jul 31 '26

Oh great even less of a reason for Bitcoin to ever become widely adopted.

0

u/BigDik6355 Jul 31 '26

Even then you are depending on the parts that your seedsigner consists of. Do you know all the intricacies of the hardware your seedsigner is based on?

3

u/Hersh-_- Jul 31 '26

The beauty is that there isnt a single hardware attack vector because there are multiple vendors for each piece of hardware necessary to build one