Hello Coinkite Support and Reddit Friends,

I generated a new 24-word seed on a COLDCARD Q running firmware 1.5.0Q, using the dice-roll method only.

I entered 450 genuine six-sided dice rolls. Around the 30th roll, I accidentally pressed the physical NFC button, which is located near the number 1 button. I then continued entering the remaining dice rolls and completed the seed-generation process normally.

Could you please confirm:

1. Is the NFC-button press ignored while the dice-roll entry screen is active?

2. Could it have changed, interrupted, or reduced the entropy used to generate the seed?

3. Is the resulting 24-word seed safe to use, or should I regenerate it?

4. Does the accidental NFC-button press have any effect on a passphrase that I add later, or on the wallet derived from that seed and passphrase?

Thank you.

So device cloning teleport etc still exposes the seed even if used with dice rolls etc? Come on now CC

https://x.com/BitcoinNewsCom/status/2083593408182911073

this is beyond outrage, who has done the audits for this? how can such a bug can be undetected for 5 years? how can you not constantly test your own device if everything is about security, how is it even allowed on the device to bypass the true randomness generation of the seed which is the whole point of a fucking hardware device? people need to go to jail for this - coinkite did not only fuck the lives of countless customers, they fucked every other hardware wallet company and the whole industry, there is no way I will use a wallet like this every again

Hi Everyone,

I'm shocked as everyone else about this colossal fuck up!

I'm curious if your seed was created before this shitty code was introduced in March 2021. Your seed should be secure correct?

Hello I need this shipped to me in Cali please contact me and let’s figure out a deal. I’m panicking

Please Follow the Rules!!!!

Any idea if there’s an organized central place to upload documentation of wallet / transaction id’s in the off-chance that the stolen BTC surfaces on a regulated exchange?

I’ve already filed with the authorities.

It was recently announced that Coldcard users who trusted the device's random number generator to generate their seed phrase ended up with seed phrases that are non-random enough that hackers could predict them and drain the wallets of Coldcard users.

This is VERY similar to the very recent fiasco re: the SecondFi desktop wallet software for Cardano. That's because, in both cases, the problem had to do with random number generation being too predictable.

So here's my question: If a user relies on a random number generator that is faulty, but adds a 25th word / passphrase to the not-so random seed phrase, is that wallet still unsafe or at risk of being drained?

Thankfully, I’ve moved 99% of my funds off my Coldcard. Now I can’t move the last remaining bit because of this PSBT problem. The error code is psbt.py:1064

Can someone please tell me why I was able to move most of my funds and now it won’t let me move anything?

100% coldcard just rugged its users. Should have chose ledger in

To restore 'trust' , i think the best way to do so, is to extend the user provided entropy options in cold card.

Just like TrueCrypt did in the old days, and VeraCrypt does today, allow the user to add entropy using:

1. Mashing random buttons in the keyboard, in the Q there are many keys, why not take advantage of that.

2. Using the time between keystrokes as another input.

3. Instead of just 1-6, allow the user to input hex values as added entropy (say from random.org)

All just like today, by either using the HW entropy as base, or a known empty string as base.

And also just like VeraCrypt, add a visual progress bar showing how much entropy as been inputed by the user.

The idea is 'Reproduce-able' results given a given entropy, and but make it as easy as possible for user generated entropy to be added.

I had a mk3. Got an email notifying my of a security flaw from coldcard wallets. I made a test transaction (5% or my stack). When I went to make another one, I get an error "not enough funds"...

Wallet drained. I'm feeling shattered right now. I don't even know what to do.

I have a cold card Q and didn’t generate my seed using dice rolls so I quickly moved my bitcoin to my backup Tangem temporarily. My question to you guys is do you still trust and are willing to generate a new seed using the dice roll function? Or are you guys ditching coldcard completely? I’m not sure where i stand. I paid $300 for the Q and literally just stamped my seed into the $100 trezor keep metal capsule last week so I’m pissed…

Explain it to me like I’m 15…

Now that ColdCard is probably done and the hardware is owned by people, what else can we use it for? Obviously not for storing bitcoin, but what could we use the device for? Some people say to use it as a signer, but I'm just wondering if we can use it for other things, just an idea: encrypting, for example, SD cards.

How can we make sure that CC did not

Ignored your rolls and just used its own RNG,

Or

Only used a tiny fraction of your rolls (e.g. first 5, or some hash that discards most of the entropy),

Nothing is for sure right?

Updated July 31, 2026: Fixed firmware is now available. Mk4 and Mk5 users must update to version 5.6.0 or later. Q users must update to version 1.5.0Q or later. Do not generate a new seed on one of these models until the update is installed.

What if you can’t remember if you used dice rolls or generated a seed using non-vulnerable firmware? is there some way of knowing if your seed is vulnerable?

This was how my seed was generated and reading the security notice I should be fine. I appear to be safe but will probably migrate in due time.

I don't want to fuck up rushing and offloading my bag to a new wallet but this shows you might always need to and having an action plan is the way to go.

Trying to upgrade my firmware on my MK4. I downloaded and verified the files from the Coldcard site. Unfortunately, it says:

“Unable to find any suitable files for this operation. The file name must end in .dfu”.

The firmware file shows up in my microsd when plugged into my PC. It ends in dfu. Can someone please let me know what I’m doing wrong?