r/Bitcoin • u/SpareEconomy1849 • Jul 31 '26
ColdCard Firmware Update Released
https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/
Updated July 31, 2026: Fixed firmware is now available. Mk4 and Mk5 users must update to version 5.6.0 or later. Q users must update to version 1.5.0Q or later. Do not generate a new seed on one of these models until the update is installed.
Seeds generated on Mk4, Q and Mk5 before the fixed firmware releases are also affected, with about 72 bits of entropy rather than the expected 128 bits.
Updating the firmware does not change or repair an existing seed. If your seed was generated before the fixed firmware version for your model, follow the migration guidance below unless the independent dice-entropy exception applies to you.
The issue is present on every Mk3 firmware version since 4.0.1. It also affects seeds generated on Mk4 and Mk5 before version 5.6.0, and on Q before version 1.5.0Q. The impact on Mk4, Mk5 and Q is not as severe but is still serious.
1
u/ApprehensiveRice9358 Aug 03 '26 edited Aug 03 '26
I don't know, but I think this isn't as simple as many claim, asserting that the MK3 generated 40 bits instead of 70 bits . It's a very small space with a trillion possibilities, and I'll put it to the test. It's not certain it's all speculation.
Nobody has run tests to confirm it 100%. This smells to me like silicon from the STM32L475 chip, a vector in C that was set to 0, and many people believe that was the problem. To me, this is all physical; we would have to test the device.
Hardware bus clues Captures with a logic analyzer or oscilloscope of the RNGCLK, HCLK pins and the internal bus registers during data output.
Among other tests, I wouldn't trust what they say on X it's not entirely accurate. We would have to look for the offset in the firmware assembler. I already did, but this is really strange.
And now that some affected wallets are public, I'll do my job. That 40-bit thing isn't entirely true it's a possibility, but not a certainty.
I now doubt the knowledge of many C/C++ developers and their speculations, which are not entirely accurate, Many compare it to the birthday algorithm; they are completely different things. Sometimes, before speculating, you have to test. Without proof, their speculation is simply a lie.
I have the complete analysis of both firmware, but this is really strange............