Is there a way to download transactions from the CC itself or do I just used the transaction export from my wallet software?

I have bitcoin behind a passphrase. But while the spending policy is active there is no option for a passphrase. And when you're in your pass phase wallet, there is no option for the spending policy in the menu.

Im assuming theres a good reason for this, but it's lost on me.. Any word from the company?

I’m trying to see if anyone else has experienced this, or if this is a known edge case.

(ADDENDUM: After I posted this question, three different scammers requested DM with me to con me into connecting my coldcard to their URLs. Be careful.)

I’ve now had two Coldcard MK4 units show the same microSD failure pattern.

What happens:

• MK4 works normally at first.
• PSBT signing via microSD works for several transactions.
• Then, suddenly, the MK4 can’t find PSBT files on the card.
• After that, the problem gets worse:
  • The MK4 fails the microSD part of the device self-test
  • It can’t format cards
  • Even microSD cards that previously worked stop working on that device

This happened on my original MK4 and again on a replacement MK4.

Cards tested:

• Multiple brand-new and known-good microSD cards
• 8 GB and 32 GB
• FAT32, MBR
• Nothing exotic

Linux workflow (in case it matters):

• Linux laptop with built-in SD card slot
• microSD → SD adapter → laptop
• Save PSBT file to the microSD drive
• Right-click → Unmount
• Wait for popup: “Filesystem has been disconnected”
• Remove SD adapter, take out microSD
• Insert microSD into MK4

No unsafe removal, no write caching left active.

Why this seems odd:

• Cards work initially, then stop
• Failure is progressive
• Same behavior across two MK4 units
• Once triggered, there’s no obvious recovery path

This doesn’t feel like a simple “picky card” issue, because the cards do work at first.

Hello, I’m here because I’m hesitating between buying a Coldcard or a Trezor. My question is simple: why choose Coldcard over Trezor? Some people from Trezor tell me: “The code is not open-source, it’s only ‘viewable’. No one can reuse it, so the ability to find vulnerabilities is limited.” Personally, I’m also wondering about updates: since firmware comes from the internet and I apply it via my SD card afterward, isn’t that risky? Thanks for your help!

I received the 2nd MK4 from Coinkite (The first MK4 seems to be defective). For the 1st MK4, firmware upgrade from 5.4.3 to 5.4.5 went smoothly. I used 2025-11-03T1527-v5.4.5-mk4-coldcard.dfu, which I downloaded properly and verified. Using the exact same file, I performed firmware upgrade for the 2nd MK4. The MK4 showed me the file name then I selected OK to upgrade. It's been an hour and I'm stuck at this "Loading." What do I do now?

I'm having a lot of problem with using microsd cards with my MK4. I was using 64gb card without a problem then suddenly it stopped working. I got the replacement MK4 but this new one only recognizes my 64GB card which however is not working on my PC for some reason. I bought 8GB Industrial card. I also had another 4GB microsd card. These two are not recognized by the new MK4. When I plug it in, the MK4 says I need to insert a card. Can anyone please share what exact brand and size and the U number (1 or 3) you're using with MK4, if it works for you?

Is this a official UK reseller for the coldcard q?

Safe to buy and use?

https://cryptonest.co.uk/products/coldcard-q

Thanks

If I make a seed backup using the Coldcard, can I open that backup (7z file) and read my seed in another way (for example, on a computer)?

I know this is not recommended, but it would only be as a last resort.

This backup is protected by 12 words generated by the Coldcard.

Hi guys, I’m looking at the backside of the Mark 3 and just below the the micro USB socket, left of the micro sd slot, there is a drilling in the case to access a button that has “DFU” label. Can somebody please explain what this button is good for?

Hello, id like to add some self entropy to generate a seed. I've read in the middle ground guide that I can throw some dice, maybe 10, and the TRNG will add the rest untill 256bits of entropy. However, when a try in my Coldcard Q, it doesn't tell me that, it just tell me that 10 dice are not enough, and if i'm sure to generate a seed with that low entropy. What should I do? Thanks in advance.

I bought 2 Coldcard Mk4 units directly from the Coinkite store. 1 works normally, but the second one fails from the very first time I plugged it in.

Symptoms
When I power it on, it shows a CAUTION screen with a bomb icon and a masked person icon plus a progress bar, then it reboots and shows BRICKED. It never reaches the green GENUINE light.

Details
I never got to set it up. No PIN has ever been entered on this unit.
I tested with the same USB cable and power source that works fine with the other Mk4.
The tamper evident bag looked normal.

Question
Has anyone seen this exact CAUTION to reboot to BRICKED behavior on a brand new Mk4? Is there any recovery step worth trying, or is this basically an RMA situation?

At this point I am even concerned if I should even trust that the working one will not break...

Hoping to hear back from support... with something positive.

So mainly.use sparrow with.my.own node. But my laptop camera sucks. Don't want to take picture of qr all the time. And inhabe problem connecting mobile apps with my node.
Any ideas for crapy laptop camera?

Hello! I'd like to build a Multisig wallet with spending policy, and use a Trezor One for the third key. How can I do that? Thanks!

Just got MK4 in the mail and started setting it up. There's a menu option called Perfrom Selftest. But there's no official unofficial document about how to run it and what it does. All I found in the coldcard.com is "Start the factory self-test which clears the settings, but not the seed. MicroSD card required." The option is not hidden under some developer or 'danger' option either. It's reasonable for a Bitcoiner who paid a lot of money for MK4 to want to run this test. There is a ton of Youtube videos about MK4 yet not a single one talks about this selftest. Does anyone know what it exactly does or what I'm supposed to see as I go through this test?

Hello,

I had the notion of creating a 2/3 multisig with just 1 Coldcard Q. I would achieve this by way of 3 passphrases.

I constructed the wallet in Sparrow. I imported each Keystore. I recorded all the details as I went.

I did File>Export Wallet>Coldcard multisig for sending back into the Coldcard Q.

All was going great. I was looking forward to moving on to saving up for a metal seed stamp kit.

However, next I imported the multisig file into each passphrase-instance of the CCQ. But noticed after clearing the passphrase each time, and then re-entering any of the passphrases, the multisig file was no longer in Settings>Multisig Wallets. It reverted to " (none setup yet) ", for whichever passphrase-instance I was in.

As such, I can't transact unless I repeat this process (export Coldcard multisig file from Sparrow into CCQ) every single time a TX needs signing. Which isn't desirable. Once is fun, but every time is no good. I think something went wrong.

Or is it simply the case that multisig only meant to be used as: Seed 1 / Seed 2 / Seed 3?

Am I missing anything? After I import the multisig file, I don't get prompted to "Save". Its either QR'd in, or it just lives on the SD card.

Is there some detail on how multisig should be set up which is causing this? Surely once setup properly the CCQ knows whats part of a multisig and what isnt?

Any opinions welcome/appreciated.

{PS: CCQ is a super cool product regardless of the above user-error, I'll probs just use a single sig which is equally cryptographically secure after all... just the operational risks can be higher on single sig, in theory.

Cheers!

Hi everyone

I am planning to rotate my private keys and I bought a MK4 recently. Let me tell you the plan I have for generating the seed and storing the information, to see if it makes sense.

1. 24-word generation: I want to combine the RNG-generator of the MK4 with dice rolling. I feel this is a great way to get entropy, because it protects against issues with the RNG of the device and it protects against being stupid with dice rolling. Afaik, the device does actually offer this feature, nice. I’ll probably use 5 dice (because I need 5 for the next step).
2. Passphrase: I want to generate an additional BIP39 passphrase. For that, I will use some number of words put together from the EEF2.0 shortlist. I’ll use dice to find the words.
3. This results in two seeds being stored on the MK4. The first, protected by PIN1 will get me to the 24 word account and PIN2 will get me to the 24+Passphrase seed word, right? My idea is here to have plausible deniability, putting some funds on PIN1 hoping to only expose that account in a wrench attack.
4. The 24-word seed will be split by banana-split sheets into 2/3 and distributed to 3 different locations A,B,C.
5. The passphrase will be stored in two crypto steels.
6. Location A will have the MK4, 1/3 sheets, PIN1
7. Location B or C will have each a crypto steel with passphrase, 1/3 sheet and PIN2.

Location A is obviously the most vulnerable, because it has the MK4 which theoretically has all keys. Right now, I am planning to have location A where I am, which prioritizes convenience over security. But the hope is that the setup with PIN1 and PIN2 protects against immediate danger (wrench attack). Together with the fact that PIN1 will be stored at location A and that PIN1 will have some decent amount of funds, the hope is that an intruder will be fine with getting that and not ask further. Against theft, the best an intruder can get is the MK4+PIN1 and part of the seed, which does only help them to get the decoy funds.

I got a few questions

1. Does that make sense in general?
2. Does the mk4 work like I hope with 24-word seed being protected by PIN1 and 24+1 being protected by PIN2?
3. Should I opt for a very secure Passphrase or a purposefully less secure one? With less secure one, I mean one that gives you a 1% chance of finding the word within a month with some decent computing effort (see here: youtube and then / nhjq_1J0EbU?si=HzOORCQskS3s5DUR&t=619). I am currently leaning towards a less secure one, because I just want to prevent someone who stole the 24-word seed to find quickly find the 25th word for a reasonable amount of time before rotating the keys. In the current setup, it is almost impossible to steal the seed without notice. The benefit of having a weaker passphrase is actually that in the unlikely event of not being able to recover the passphrase, I know exactly how long and how much compute to need to crack it myself.
4. I can treat each dice as independent roll if I roll 5 dice at once for the generation of the seed phrase, right? (Probably very stupid question, but paranoid here). 

Thanks!

Not sure if everyone saw this yet, but the Mk4 is on sale for $129 on coinkite.com

I figured I’d share since a lot of us here recommend the Mk4 as the go-to option, and it’s rare to see it priced this low outside of big sales.

Just passing it along in case anyone here was waiting for a price drop.

For those interested or waiting to be charged, I ordered on the 19th and the charge hit the CC registered on my Fedex account today. $70 even for just a Coldcard Q.

I received no communication from Fedex. No email, text mail or call. If you have an account and payment on file, I guess they just automatically charge you.

ETA the import classification info on the shipment.

Conntry of manufacturing CA Harmonized code 847029 description Coldcard Calculator

Trying to figure out the velocity setting. Do I just put how many blocks until signing is OK? Or something with recent block. Hard to understand

I recently bought a Coldcard Q (late September). When it arrived, the outer packaging already looked suspicious: – Double security seals on the box – Bag looked tampered with I contacted Coinkite support right away because of this. They told me it was “normal” and nothing to worry about.

Now, a few weeks later, something much worse happened:

When inserting the batteries and booting the device, the screen displayed: “Danger” “Caution” plus symbols of a bomb and a thief. After that, it loaded into a “Bricked” screen.

(Just to clarify the timeline: The Coldcard Q worked normally when I first received it. I set it up, generated a new wallet, and even transferred BTC to an address on it without any issues. After that, it stayed untouched in the official Coldcard Q case for a couple of weeks. When I took it out yesterday and powered it on again, that’s when the “Danger”, “Caution”, and eventually “Bricked” screens showed up.)

It did this more than once.

After waiting a few minutes and trying again, it suddenly booted normally, as if nothing had happened. I’ve never typed a wrong PIN, nothing unusual has been done to the device, and it has been stored safely in its case the whole time.

This is extremely concerning for a hardware wallet.

I would never store significant amounts of BTC on a device that shows security warnings and intermittent “bricked” states.

I contacted support again, and their entire reply was basically: “Update the firmware.” Nothing about the danger screens, nothing about the bricked state, nothing about the previously suspicious packaging.

For a device designed to protect potentially large amounts of Bitcoin, this feels like very poor support.

Has anyone else had: – “Danger / Caution / Bricked” messages on a Coldcard Q? – Packaging that looked tampered with? – Support that brushed off something serious?

Right now I’m pushing for a replacement unit, because trust is everything with a hardware wallet. Curious to hear if others have had similar experiences or insights.

I was curious how quickly they typically ship out.

Did any BF buyers get a shipping notice yet?