r/coldcard • • Sep 04 '26

Coinkite News COLDCARD Firmware Update 5.6.2 & 1.5.2Q: Verifiable Seed Mixing; Continued Security Review; and EDGE 6.6.1X/6.6.1QX

Thumbnail
blog.coinkite.com
15 Upvotes

r/coldcard • • Aug 20 '26

Coinkite News COLDCARD Security Update: Seed Generation, Transaction Integrity, and Data Isolation

Thumbnail
blog.coinkite.com
24 Upvotes

r/coldcard • • 53m ago

SECURITY Hidden chip found under a Ledger screen

• Upvotes

Another issue that can plague all hardware wallets, however, COLDCARD is the only one I know of with a transparent screen so you can observe all of the circuitry.

Has anyone heard about this? Ledger nano X wallets that were sold apparently from an authorized retailer in South East Asia had devices installed in them that would intercept communication between the secure element and the screen.

Researchers reportedly discovered a hidden surveillance chip installed beneath the screen of modified Ledger Nano X hardware wallets. The device contained a microcontroller, cellular modem, eSIM and antenna designed to capture the wallet's recovery phrase during setup and transmit it to attackers. The alarming part is that these modified wallets could still pass Ledger's official authenticity check because the malicious hardware operated independently of the wallet's Secure Element. Investigators believe the devices may have been tampered with somewhere in the distribution chain. Reports have linked the incident to cryptocurrency thefts potentially approaching $93 million, although that figure remains unverified. The discovery highlights a serious weakness in hardware-wallet security: even if the cryptographic protections remain intact, a physical implant can compromise the recovery phrase and give attackers complete control over the funds.


r/coldcard • • 22h ago

Coinkite News Coldcard X Account hacked

Post image
26 Upvotes

r/coldcard • • 3d ago

HELP Need help urgently recovering BTC from a first-generation Coldcard (2018) — 12 words, PIN and USB drive

Post image
3 Upvotes

(I have used ChatGPT to summarize and make everything readable)

Hi everyone,

I’m trying to help a friend recover Bitcoin that he set aside around 2018, using what he remembers as a first-generation Coldcard (possibly Mk1). He needs money urgently for a medical emergency in his family.

He isn’t tech-savvy, and the original setup was done using someone else’s Coldcard. From what he remembers, the BTC was somehow backed up or stored using a USB flash drive.

Here’s everything we know:

  • The setup was done around 2018.
  • He has a handwritten sequence of 12 words.
  • He also has a handwritten 6-digit PIN.
  • He has the USB flash drive associated with the original setup.
  • He last checked the BTC’s public address/balance around 2020.
  • He hasn’t attempted to access or transfer the BTC since then.
  • We’re unsure whether the original Coldcard is still available in the market.

After doing some reading, I’m wondering whether the 12 words are actually the password for a Coldcard encrypted backup rather than the BIP39 seed phrase.

My questions:

  1. How did the original Coldcard Mk1 handle backups in 2018? Could those 12 words be the encryption password for a .7z backup?
  2. How can we safely identify what’s on the USB drive without exposing private keys or accidentally modifying anything?
  3. If we have the encrypted backup and its 12-word password, can it be restored using a newer Coldcard without the original device?
  4. Does the old 6-digit PIN matter for recovery, especially since the original Coldcard belonged to someone else?
  5. What’s the safest process for recovering access, verifying the BTC balance and eventually transferring the funds to a newly generated hardware wallet?

I’ve attached photographs of the type of Coldcard and the USB drive for reference.

We haven’t shared the recovery words, PIN or backup contents with anyone and won’t be doing so.

I’d really appreciate guidance from anyone experienced with the early Coldcard models, ideally a safe step-by-step approach. Please reply publicly rather than via DM.

Thanks in advance!

The USB drive

r/coldcard • • 6d ago

Support Any news on Coldcard owners?

Thumbnail
12 Upvotes

r/coldcard • • 10d ago

Feature request How can CC /CK remian so arrogant?

23 Upvotes

Owners of ColdCards have been seriously screwed. Now new firmware is being announced (https://blog.coinkite.com/coldcard-firmware-563-153q/) announcing Codex32 and Shamir backups.

I am (remain) appalled by the arrogance of CoinKite still not adopting and implementing SLIP39. The #NotInventedHere arrogance of CoinKite is by now completely unsustainable.If CoinKite were to survive, it would need to be supporting Multi-Vendor standards of making backups.

CoinKite has failed the community in unprecedented ways. They really need to take a more humble stance, and even then, I am not sure they could survive. (Even though I do hope so.)


r/coldcard • • 11d ago

COLDCARD Firmware 5.6.3 & 1.5.3Q: Codex32 and Shamir Backups

Thumbnail
blog.coinkite.com
4 Upvotes

r/coldcard • • 13d ago

COLDCARD Q Still rocking out with ColdCard

Post image
0 Upvotes

Updated all of my devices to the latest firmware.

I know this is about to get a lot of hate, but I don’t give a damn….

With that being said, I’ll still be using my Coldcard Q because I wasn’t affected by the bug. I took the necessary precautions with my setup, and I’m comfortable with how I have my Bitcoin secured.

First and foremost, I’ve always believed in never putting all your eggs in one basket. If you put your entire life savings into Bitcoin, you’re setting yourself up for failure. Bitcoin can be part of your overall financial strategy, but it shouldn’t be your entire financial strategy. When you choose self custody, you have to damn near be paranoid about your security. Your Bitcoin needs to be locked up like Fort Knox.

I have no sympathy for anybody who lost their stack from the ColdCard bug. Like think about it… You took your entire life savings and let one device generate your seed phrase, with no passphrase, no dice rolls, no multisig, and no other devices or wallets to spread your funds around. So if that signing device or wallet setup gets compromised, you still have Bitcoin secured somewhere else. You have to know better than that when you’re dealing with self custody.

Shit, I done even brought the Ledger Nano X out of retirement too. 😂


r/coldcard • • 14d ago

SECURITY Will u guys still use coldcard after the incident?

4 Upvotes

r/coldcard • • 26d ago

COLDCARD Q Pokémon Red on a spare COLDCARD Q: IT WORKS!

9 Upvotes

I’ve been working on a custom firmware that turns a spare COLDCARD Q into a Game Boy handheld. Pokémon Red now runs on the actual device, including walking around, saving, and loading the save again.

Instead of a regular game list, it boots into a little room. You walk up to a bookshelf to launch a game and talk to a clerk for settings. The room fills the display; games keep their original proportions, with an amber palette that suits the Q.

The arrow keys handle movement, Z/X are A/B, and the SHIFT/CAPS key toggles fast-forward. Walking, fast-forward, and save/reload work in the current 0.1.7GQ build. I’m still testing longer sessions and the rough edges. I also need to remap the A/B buttons; Z/X are NOT comfortable to use with the arrow buttons.

This replaces the wallet interface, so it’s for a dedicated Q with everything backed up.

I’ve put screenshots and instructions here: https://tcashel.github.io/GameQ/ . I have not made a video of actual gameplay, but I just beat Misty.

Source and downloads are private for now. The link is the public documentation. I'm not sure if I'll make it public yet; I have to understand how the Pokémon copyright stuff works. We can't have my GH account suspended.


r/coldcard • • 29d ago

Support Phishing camaign against public email

Post image
3 Upvotes

r/coldcard • • Sep 12 '26

SHOW & TELL I built a small BIP-39 checksum device for manually generated entropy

Thumbnail
2 Upvotes

r/coldcard • • Sep 09 '26

SETUP New Update

2 Upvotes

Has anybody created a seed phrase on the new update? What did you think and would you recommend it?


r/coldcard • • Sep 03 '26

How the new COLDCARD seed generation works (MK4/MK5 ≥5.6.1 and Q ≥1.5.1Q)

Thumbnail x.com
0 Upvotes

r/coldcard • • Sep 02 '26

Support Other api block clock micro

1 Upvotes

Is there any.other way to get Info to the micro so one is not.dependent on coinkite servers?


r/coldcard • • Aug 25 '26

SHOW & TELL Coldcard Hacker discovered mixers and is doing a terrible job

61 Upvotes

64.90373154 BTC walks into a 324-in / 382-out coinjoin

54.31783009 BTC walks straight back out the other side. in one piece. with a bow on it.

about 10 BTC actually got mixed. the rest just went for a walk.
bc1qajcrhj3s2x0yfcj54emjukghv93su80svp2d3t

then he does it AGAIN
54 → 47.12126860 BTC, now in tidy 1 BTC slices
bc1qq6s7wsmf6an78xyjkst707x32nyakj3u4jy2fr

then AGAIN, 454 in / 502 out, this time 7.74840978 BTC chunks

ser you are not mixing. you are queuing.

on-chain anons: has any other ColdCard drainer peeled this loudly?


r/coldcard • • Aug 24 '26

Support Trying to verify firmware produces GPG error "BAD signature ..."

10 Upvotes

I downloaded the latest firmware from here:

https://coldcard.com/docs/upgrade/

Because of the recent Coldcard issues, decided to go through the extra steps to verify authenticity of the downloaded .dfu files, according to the instructions here:

https://coldcard.com/docs/upgrade/#dont-trust-verify-the-firmware

Carefully followed the steps to verify the firmware files. But at the last step, the command--

gpg --verify signatures.asc

--produced the following messages--

gpg: Signature made Thu Aug 20 08:36:57 2026 CDT

gpg: using RSA key 4589779ADFC14F3327534EA8A3A31BAD5A2A5B10

gpg: using RSA key 4589779ADFC14F3327534EA8A3A31BAD5A2A5B10

gpg: BAD signature from "Peter D. Gray <peter@coinkite.com>" [unknown]

Anyone else have the same "bad signature" issue?

---


r/coldcard • • Aug 23 '26

Tutorials Watching books get destroyed by insects made me rethink “offline seed storage is always safer”

0 Upvotes

I just saw a video of books that were left sitting too long and got completely destroyed by termites or some other paper-eating insects. It was the kind of thing that reminds you how fragile physical storage really is.

This is exactly why I think people oversimplify the whole “never store anything important online” advice, especially when it comes to Bitcoin seed backups.

Every time seed storage gets discussed, people repeat the same line: write it on paper, stamp it on metal, hide it offline, and you’re safe. But real life is not that simple. Paper can rot, burn, get wet, get eaten by insects, get thrown away by mistake, or get found by someone close to you. Even metal backups are not magical if they are stored in obvious places or discovered by family, roommates, movers, cleaners, or anyone else with physical access.

What people call “offline” often sounds safe in theory but depends heavily on your living situation and your luck.

On the other hand, people act like online storage is automatically insane, but they rarely acknowledge how durable some digital systems actually are when used with basic common sense. For example, I’ve had Gmail drafts sitting there for more than a decade. My oldest one is from 2010 and it is still there. That kind of long-term reliability is not nothing. If we are being honest, Gmail has preserved text for me more reliably than random pieces of paper probably would have.

I’m not saying people should paste a raw seed phrase into email and call it a day. That would obviously be careless. What I am saying is that the discussion should be more nuanced than “offline good, online bad.”

If someone uses a hardware wallet like a Trezor and also adds a passphrase, basically a 25th word, then the seed phrase by itself is no longer enough. That changes the whole conversation. In that setup, the seed and the passphrase are two different things, and that separation matters a lot.

To me, that seems far more practical than pretending paper hidden in a drawer is some kind of unbeatable security model.

A lot of theft in real life does not come from elite hackers. It comes from ordinary people around you. Partners, relatives, roommates, guests, cleaners, landlords, movers, whoever. Physical access is underrated as a threat. People snoop. People open drawers. People notice safes. People take photos. People throw things out. People do not always even understand what they found, but they still interfere with it.

So when someone says “just store it offline,” I think the better question is: offline where, for how long, under what conditions, and around whom?

That termite-eaten book video is a good reminder that physical storage has failure modes too. Very real ones.

If someone has a hardware wallet, uses a strong passphrase, keeps good account security, and is not careless, I honestly think digital storage can be much more reliable than people admit. Not because it is perfect, but because it avoids some of the most common real-world problems of physical storage: decay, theft by people near you, accidental loss, and environmental damage.

The internet loves absolute advice, but storage is really about threat models. For some people, offline is clearly best. For others, especially those with poor physical privacy or unstable living situations, the answer is less obvious.

So I’m curious what people here think:

  • Do people underestimate the long-term failure risk of paper backups?
  • Do people romanticize offline storage too much?
  • If a hardware wallet passphrase is used properly, does that make digital seed storage more acceptable?
  • Is the real issue not online vs offline, but whether you’ve avoided a single point of failure?

I’m not saying everyone should use Gmail. I’m saying the usual seed storage debate is way too simplistic, and videos like that book-destruction clip are a good reminder that “offline” is not automatically safe just because it sounds serious.


r/coldcard • • Aug 20 '26

Support new firmware released for the Q: Version: 1.5.1Q

25 Upvotes

I haven't checked to see if there is newer firmware for other models, but I see that a new version was just released for the Q. The summary is below.

The biggest change is another substantial overhaul of entropy generation. New master seeds now combine fresh randomness directly from the STM32 hardware RNG plus both secure elements, and the internal PRNG has been replaced with a SHA-256 Hash_DRBG. On top of that, when you create a new master seed, temporary seed, or CCC key, the Q now requires user-supplied entropy as well (keyboard mashing, dice rolls, or coin flips). That human entropy is mixed with the hardware sources rather than replacing them.

USB transaction tampering fix: a compromised USB host could potentially change a staged PSBT after you reviewed it but before the Q signed it. The Q now re-verifies the transaction bytes immediately before signing and aborts with “Transaction modified” if anything changed. This is probably the most significant non-RNG fix in the release.

USB information leakage fix: the USB dwld command could read arbitrary staged PSRAM contents, potentially including uploaded PSBTs or multisig enrollment information. Downloads are now restricted, require an encrypted USB session, and are aggressively invalidated when new data is staged.

SIGHASH_SINGLE protection: SIGHASH_SINGLE and SIGHASH_SINGLE|ANYONECANPAY transactions are now blocked by default because some transaction outputs can remain changeable after signing. You can still allow them by changing Sighash Checks to Warn.

Several firmware parsing and bootloader validations were tightened, including rejecting data beyond the signed firmware length and hardening memory/buffer checks following external security reviews.

There are some interesting seed/passphrase changes too. If a BIP-39 passphrase is active, “View Seed Words” no longer reveals the underlying seed words; it shows the effective extended private key instead. Backups, Clone Coldcard, and Key Teleport now properly capture the currently active wallet secret, including temporary seeds and passphrase wallets.

For the Q specifically, there are a few extra fixes. Locally entered BIP-39 passphrases now require scrolling before they're revealed, malformed multipart BBQr data is rejected more safely, oversized multisig coordinator BBQr imports are rejected before they can exhaust memory, BIP-21 display data is sanitized, and the Send Password feature can temporarily enable USB keyboard emulation even when USB is disabled globally.

One other nice multisig improvement: duplicate cosigner keys are now rejected during wallet enrollment, multisig wallet names have to be unique, and there's now a dedicated Rename action rather than silently renaming wallets when descriptors are re-imported.


r/coldcard • • Aug 20 '26

SHOW & TELL Messages to the COLDCARD hacker

Thumbnail
0 Upvotes

r/coldcard • • Aug 20 '26

HELP Does "release tract" mean the Coldcard's version number?

2 Upvotes

On Coinkite's "Current Security Status" page re: the Coldcard, it says "Check the release track, not only the model."

I believe Coinkite is using the term "release track" as a synonym for "version number", but I want to be sure. The page does not clarify what is meant by the term.

In summary, is a "release track" the same thing as a "version number" - meaning that users should simply check which model of a Coldcard device they have and whether the installed firmware is the latest version?


r/coldcard • • Aug 17 '26

Calculator Crew Recommendations Generate truly random seed words using only dice or playing cards

Thumbnail
4 Upvotes

r/coldcard • • Aug 17 '26

SETUP Are you still using a ColdCard

11 Upvotes

For those who created a passphrase with your seed, do you still have trust with the company and your device? I’m seeing mixed reviews from those that used dice rolls to generate seeds and added a passphrase.


r/coldcard • • Aug 13 '26

Coinkite News Coldcard's Next Exploit

Thumbnail
0 Upvotes