Coldcard Firmware Update After $114M Theft Due to Seed-Generation Flaw

Coldcard has released firmware 5.6.1 to address a seed-generation vulnerability exploited in an attack that drained $114 million (1,816 BTC) from users' hardware wallets. The vulnerability affected customers using Mk4, Mk5, and Q devices, allowing hackers to exploit weak seed generation methods. The update introduces mandatory user-provided randomness for seed generation and strengthens transaction integrity checks. Users are advised to upgrade immediately, as existing vulnerable seeds remain unsafe. Coldcard is assisting law enforcement in investigating the thefts and continues to support affected customers in migrating their funds. The update also includes enhancements unrelated to the seed issue, such as improved USB data handling and multisig protections.

Key Points: • Coldcard firmware 5.6.1 released to mitigate a seed-generation vulnerability exploited in an attack. • The exploit resulted in a loss of $114 million (1,816 BTC) from affected hardware wallets. • Users must upgrade firmware to secure new seed generation; existing vulnerable seeds remain unsafe.