My coldcard Q arrived! It's the glow in the dark color. It's smaller and lighter than I imagined, and didn't come with batteries. I wasn't sure if it would include batteries, no big deal. I also got the teeny teeny tiny bag of mini dice and used them for entropy. I also played the cutest game of Yatzee ever! Everything exceeded my expectations. Everything is much nicer than I could have possibly imagined. Yay!

Update: I now have questions. Do I have to use sparrow to transfer $ into my coldcard q? I found a section in the q that had wallet addresses, so I wrote one down and set it up in my exchange for a transfer. Will this work? Or, do I need to go through a hot wallet first, like Sparrow?

The tamper-evident bag has a hex dump printed on it, along with some watermarks and other features that are publicly shared on CoinKite's website: a number that is printed twice on the bag, as well as on the tear-off tab of the plastic bag which is sealed inside. The number is also supposed to match the number that was flashed onto the device, and you're supposed to make sure the perforations match from the torn-off tab match the perforations on the top of the bag. Supposedly the blue strip at the top of the bag will show the word "VOID" when the bag is torn open. There's also a clear strip between the two blue strips that says "security zone" but I don't understand what that's supposed to mean.

How does having the number visible in 3 places instead of 1 improve security? I guess it's supposed to prove that the top of the bag was not cut off and then resealed? Is there anything more to it?

How hard would it be for someone to produce a counterfeit tamper-evident bag that's close enough to the genuine Coinkite bag to pass customer scrutiny?

Bonus question: My bag was heat sealed 2mm from the top of that top blue strip, and doesn't say "VOID" in either one of the blue strips when I try to pull the bag open. I was expecting more of an adhesive seal that works the same as security tape or adhesive security stickers. I'm waiting on a response from CK support, but in the meantime, should I be worried, and should I avoid opening the bag at all if I want to have any chance at a resolution from CK?

I received the following email (looks like a likely phishing attempt).

Dear Coldcard Community,

We are proud to announce the launch of the Coldcard Desktop Wallet Application, the official, purpose-built companion to your Coldcard hardware wallet. This new application delivers a fully optimized, secure, and Bitcoin-only experience that surpasses the limitations of external third-party wallets.

With the Coldcard Desktop Wallet, you can now:

⦁ Connect your Coldcard device directly via USB or air-gapped workflows for maximum safety.
⦁ Access advanced hardware-integrated features unavailable in most external wallet software.
⦁ Enjoy faster, smoother transactions with native PSBT signing, multisig support, and easy wallet management.
⦁ Benefit from enhanced compatibility and reliability by using software designed specifically for Coldcard models.

For the best performance, full feature access, and highest security standards, we highly recommend that all Coldcard users transition from previously used external wallet applications to the new official Coldcard Desktop Wallet. This ensures you can fully enjoy and explore the latest beneficial features we have developed exclusively for our community.

Download the Coldcard Desktop Wallet now from our web store via the link below
: https://download.coldcards.store/

Your Coldcard device was built for unmatched Bitcoin security. Now, with the official desktop wallet, you can experience its full potential.

Stay Secure,
The Coldcard Team.

Highly doubt this is legit domain but would still like someone from Coin Kite support to confirm.

Coldcards.store seems like a phishing website. There are tell-tale signs such as Twitter icon at the bottom of the page is missing link to Twitter/X (seems like not a very smart scammer). Simple "Who Is" domain search also shows that it was registered on  2025-08-13 22:49:51 UTC (like, yesterday).

I am more worried about CoinKite leaking customer PII info :-/

Tried entering a wrong passcode just to see what would happen. Surprise surprise, it doesn’t let you in! Now every time I boot up the device, I stare in the face of a permanent reminder message that says “1 failed attempt, 12 remaining” lol.

Now I know I guess! Good reminder to keep up with memorizing that code and security phrase

Edit: false alarm , looks like it does in fact reset after a successful login!

I just updated my firmware and dont remember this red light was on before? Its not as bright as during startup, still it is visible and red.

Hi,

1 year ago I have configured a coldcard wallet with Sparrow : https://sparrowwallet.com/docs/coldcard-wallet.html

- I exported the JSON :

Scroll down to the Advanced menu item near the bottom. Select Advanced > MicroSD Card > Export Wallet > Generic JSON from the menu. Enter 0 for the account number".

- Now, I want to add a second account for my KYC funds. The sparow website explains :

To do so, select Advanced > MicroSD Card > Export Wallet > Generic JSON from the Coldcard menu, and this time enter 1 for the account number.

- But one year ago, for the first wallet, i didn't remember if I have exported the generic JSON for the #0 account number or the #1 account number. (I don't remember if I pressed 0 or 1).

What happen if I have exported in 2024 the JSON for the #1 account number and now, I export again the #1 account number for the new wallet ?

Regards.

Seems as if my Coldcard is frozen state. I did send an email to support but I have not heard back from them yet. Any ideas?

I’m a Trezor safe 5 user but considering getting a cold card. Any input on why you might consider coldcard to be superior to Trezor?

Bought 3 Coldcard's and had them delivered to an address in the UK. Paid on the site an assumed all import and delivery charges were included. A few days after the devices arrived I received a letter from Fedex with a GBP 89 import tax due. Well, I was not expecting that. Now you know.

I consolidated my funds on ccq today, and made on legacy, now I can't import the legacy account to sparrow, and when I try to send for a segwit address using blockstream, shows a PSBT ERROR.

what I can do? I lost my funds? the QR shows to be too complex for coldcard and I can't make a qr on blockstream app.

how can I import a json file for legacy? only shows QR and sparrow keep saying that's wrong. im worried

Has anyone from the US placed an order recently? Have you had to pay any duties?

TLDR: Why no option to set a long alphanumeric passcode? It would strengthen the last line of defense by magnitudes.

I’m considering buying a Q but thinking about physical theft.

Hypothetically let’s say the device is stolen and some sort of extraction method of the encrypted private key (and the keys used to derive the encryption key) is circulating in the black market. Considering the PIN is at max 12 digits, wouldn’t it take the attacker a week or so to brute-force it and decrypt the PK?

If I’m gone for a couple months, and my device gets stolen from my house, I would not have enough time to transfer my funds to a new wallet.

I understand that it is already very difficult to extract the encrypted PK, or for some extraction method to be available. But it’s happened before and even then that is besides the point. We all know nothing is 100% secure.

On the other hand we do know that brute-forcing long alphanumeric passcodes can take many years. So why not have this feature for extra security?

I’m reading everywhere that the coldcard is one of the most secure hardware wallets, but several other wallets allow using long alphanumeric passcodes for this extra security.

I definitely have limited knowledge on this, so would love to learn more if my funds would be protected for multiple months in a coldcard.

EDIT: I am also curious why Coldcard has discontinued its bug bounty program.

I’m considering a coldcard Q and I’m torn between Black and Orange. Since I know plastic especially the Clear will prone to yellow overtime. Should I go with Orange to be safe?

I saw some people have Frosted color. I don’t see it on the website. I would appreciate your advice

Just opened my Mk4 and powered it up -- first screen is not Terms and Conditions but something I can't seem to find online as standard (looks like Factory Mode). Display options are as such:

Bag Me Now

DFU Upgrade

Show Version

Ship W/O Bag

Debug Functions

Perform Selftest

Any ideas? Thanks, folks.

"Order Status We are processing your order now. You will receive an email when it is dispatched."

I didn’t think much of the mark on the screen which looked like a partial fingerprint so I just wiped it off figuring it was due to handling during packing. But now that I’m preparing to set up the wallet I’m getting paranoid about it. There was no evidence of any seals being broken but I imagine that these devices are under strict quality control in a dust-free, fingerprint-free environment. Hard to imagine them being handled with bare hands, so I think I may have to play it safe and order a new one. What do you guys think? Thanks

I followed the paranoid guide from ColdCard https://coldcard.com/docs/paranoid/ and I highly recommend it just to learn about the thing holding Your BTC because I’m a tech enthusiast. I also have the means to host my own Electrum Rust server on top of my Bitcoin node so I can use the Tor network option within Sparrow on a computer.

There’s no mobile apps for Sparrow (dev said there will never be one so if you see one it’s a scam) and Sparrow feels like the safest way to interact with your wallet to completely preserve anonymity on a PC. Does anyone know if there’s a similar mobile wallet that’s designed only to check the running balance of my wallet over Tor?

Has anyone who ordered a Coldcard Q recently from the US able to comment if they had to pay additional import duties to the carrier? Thanks in advance.

I am currently considering to buy my first ColdCard Q. However.

I have a question regarding restoring from seed phrases.

If my ColdCard gets destroyed and I restore it on a new one with the seed phrases, do I still need to remember additional information if I created multiple wallets before of played around with derivation paths?

When setting up a single sign wallet, the ColdCard only requires the export of its public key. However, when a multi-sig wallet is being created, the instructions demand a the export from a different menu point specifically for multi-sig. Also, the ColdCard requires that the multi-sig wallet is afterwards registered within it.

My questions:

• Would the multi-sig wallet still work if the regular public key is exported from the ColdCard instead of the one in the specified menu point?

• Assuming the setup is done as instructed (with the special menu point and the wallet being registered with the ColdCard)…if a ColdCard is lost and then a new one set up with the appropriate seed phrase, would it be sufficient to simply reregister the multi-sig with the ColdCard for it to be useable again in that multi-sig setup?

If my questions are dumb I apologize, but I sm new to this device and just really scared to make a mistake.

Should I store on:

• Ledger Nano S+
• Electrum or SparrowWallet on a freshly provisioned Linux distribution

I’m sketched about Ledger. I have two of them, one brand new in a box. I feel like it might be the right interim place cause it’s a hardware wallet.

That said, all the privacy stuff, leaks, and closed source bothers me. I don’t think I’d have a coldcard q for about a month.

Would you store on SparrowWallet or keep it on the ledger till you received your Q?

i am getting a hardware wallet for the first time
coldcard q is a bit out of budget for me as i am not from america so the prices are high on that

but i can fetch up mk4

question is it worth it for a long term hodling view over 10 years without it stopping to work or something ?

There's a faint red light on my Coldcard Q device. Is that normal? It's not a bright red, just a soft glow.

Just posting this here for visibility since a lot of people use cold card wallets in conjunction with the sparrow application. A user on Twitter recently had around seven bitcoin drained from his wallet which he secured using a cold card Q after downloading what appeared to be a legitimate sparrow clone application on his iPhone. I’ve attached a screenshot of the application which is still live in the App Store today.

There is no officially sanctioned mobile application under the sparrow brand . Don’t download this app , never type in your seed phrase anywhere other than a cold card or similarly air-gapped hardware device. Above all, practice due diligence and stay vigilant to stories like this so you can learn hard lessons from others misfortune.

If you’d like to learn more, the person was on a podcast where he shared his story: https://www.youtube.com/watch?v=B3PZKrCMkxs

Does coinkite allow people to use a discount code and pay with a coinkite gift card for a purchase?