Skip to content
Coldcard Firmware Vulnerability Exposes User Funds to Risk

Coldcard Firmware Vulnerability Exposes User Funds to Risk

First seen 2 Aug 2026, 08:53 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •August 3, 2026 at 06:03 UTC
  • •Coldcard firmware vulnerability affects multiple models and versions.
  • •Funds are at risk if seeds were generated without sufficient entropy and strong passphrases.
  • •Users must update firmware and migrate to new seeds to secure their funds.

Coinkite has acknowledged a vulnerability in its Coldcard hardware wallets affecting seed generation. Funds controlled by seeds generated on Mk2, Mk3, Mk4, Mk5, and Q firmware versions are at risk if created without at least 50 independent, private dice rolls and lacking a strong BIP-39 passphrase. The affected firmware versions produced seeds with reduced entropy, compromising their security. Users are advised to migrate to new seeds after updating their firmware, as the existing seeds cannot be repaired. TAPSIGNER, OPENDIME, and SATSCARD devices are not affected. The issue was discovered through an AI review of the firmware code, which failed to identify the bug. Immediate action is recommended for users with potentially compromised wallets.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 50d ago How this analysis works

Timeline

2026-08-01
Vulnerability acknowledged by Coinkite
Coinkite confirmed a bug in Coldcard firmware affecting seed generation and security.
Article 1
2026-08-01
Fixed firmware released
Coinkite released updated firmware for all affected Coldcard models to address the vulnerability.
Article 2

More articles in this cluster (2)

Following this threat?

Track Coinkite in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (3)

1 / 3