Coldcard Seed Vulnerability Exposes Crypto Wallets to Risk

A hardware wallet built to keep Bitcoin private keys away from hackers is now telling its own customers that some of those keys may already be compromised. Coinkite, the maker of the Coldcard wallet, has pushed out new firmware meant to close a Coldcard seed vulnerability that let attackers reconstruct private keys just by tracking button presses. The fix hardens how new wallets generate their seed phrases, but it does something else too: it forces owners to confront an uncomfortable truth. If your seed was created before the patch, updating the firmware will not save it.

Key takeaways

• Coinkite released firmware 5.6.1 for Coldcard Mk4 and Mk5 devices and 1.5.1Q for the Coldcard Q, requiring new seeds to mix in physical randomness.
• New seed creation now needs at least 65 key presses, 50 rolls of a six-sided die, or 128 coin flips combined with device entropy.
• Seeds generated on vulnerable firmware stay exposed even after the update; affected owners must create a fresh seed and move their funds.
• Independent analysis from Block suggests the vulnerability window may be wider than Coinkite’s official advisory acknowledges.

Coinkite Hardens Coldcard Seed Creation After Exploit

Coinkite’s answer to the breach is a firmware rebuild that no longer lets a Coldcard generate a seed on device randomness alone. The company published the update in a blog post dated Thursday, telling owners of Mk4 and Mk5 devices to install version 5.6.1 and Coldcard Q owners to move to 1.5.1Q. Both releases were rolled out August 20, and Coinkite is urging every user to upgrade without delay.