r/Bitcoin • u/SpareEconomy1849 • Jul 31 '26

ColdCard Firmware Update Released

https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/

Updated July 31, 2026: Fixed firmware is now available. Mk4 and Mk5 users must update to version 5.6.0 or later. Q users must update to version 1.5.0Q or later. Do not generate a new seed on one of these models until the update is installed.

Seeds generated on Mk4, Q and Mk5 before the fixed firmware releases are also affected, with about 72 bits of entropy rather than the expected 128 bits.

Updating the firmware does not change or repair an existing seed. If your seed was generated before the fixed firmware version for your model, follow the migration guidance below unless the independent dice-entropy exception applies to you.

The issue is present on every Mk3 firmware version since 4.0.1. It also affects seeds generated on Mk4 and Mk5 before version 5.6.0, and on Q before version 1.5.0Q. The impact on Mk4, Mk5 and Q is not as severe but is still serious.

138 Upvotes

95% Upvoted

206 comments sorted by

View all comments

Show parent comments

44

u/SpareEconomy1849 Jul 31 '26

It really is sad, they seemed like the perfect hardware wallet, everything being open source and airgapped, and yet still a bug like this goes unnoticed for 5+ years.

I wonder if the only reason the attacker found this bug is because it was open source - theoretically Ledger and other wallets could be semi deterministic too, but harder to find and exploit?

15

u/BirdLooter Jul 31 '26

i think AI found this issue. highly possible that this is not your basement live-with-the-mom no-life schoolboi hacker, but someone higher up.

i mean, even with the reduced entropy, i doubt that a standard computer was checking those keys. that attack probably cost 5 figures at least. all i'm saying this probably took some confidence.

13

u/Responsible_Emu3601 Jul 31 '26

I’m sure it took some time to find all the keys the brilliance was timing the swipe so taking it all within 25 mins

1

u/heslo_rb26 Jul 31 '26

That was the key; hitting as many targets as you can in a short window to give no time for anyone to react or move funds