Coldcard Adds New Security Measures After $130 Million Bitcoin Exploit

In brief

• Coinkite released new Coldcard firmware after a seed-generation flaw exposed users to more than $100 million in Bitcoin thefts.
• Coldcard now requires users to add randomness through key presses, dice rolls, or coin flips when generating new seeds.
• A three-week review also uncovered issues involving transaction signing, USB connections, backups, and other wallet functions.

Coldcard maker Coinkite has released a security overhaul for its Bitcoin hardware wallets after a seed-generation flaw allowed attackers to steal more than $100 million in Bitcoin.

In a blog post on Thursday, Coinkite urged Coldcard Mk4, Mk5, and Q users to upgrade to firmware 5.6.1 or 1.5.1Q. The release follows a three-week review of Coldcard's systems that included outside security researchers and AI models including Kimi.

“We are grateful to the security researchers who went above and beyond over the past weeks, reporting issues, reproducing edge cases, and reviewing our fixes,” the company wrote. “Their work put this firmware under intense, sustained scrutiny and made this release stronger.”

In July, attackers began draining Bitcoin from air-gapped Coldcard wallets after exploiting a firmware flaw dating to 2021 that generated some wallet seeds with too little randomness, making their private keys easier to guess. The first attack drained 594 BTC, worth about $38 million, from roughly 500 wallets in 25 minutes.