Coldcard Firmware Vulnerability Exposes User Funds to Risk

Coinkite has acknowledged a vulnerability in its Coldcard hardware wallets affecting seed generation. Funds controlled by seeds generated on Mk2, Mk3, Mk4, Mk5, and Q firmware versions are at risk if created without at least 50 independent, private dice rolls and lacking a strong BIP-39 passphrase. The affected firmware versions produced seeds with reduced entropy, compromising their security. Users are advised to migrate to new seeds after updating their firmware, as the existing seeds cannot be repaired. TAPSIGNER, OPENDIME, and SATSCARD devices are not affected. The issue was discovered through an AI review of the firmware code, which failed to identify the bug. Immediate action is recommended for users with potentially compromised wallets.

Key Points: • Coldcard firmware vulnerability affects multiple models and versions. • Funds are at risk if seeds were generated without sufficient entropy and strong passphrases. • Users must update firmware and migrate to new seeds to secure their funds.