Coldcard Adds New Security Measures After $130 Million Bitcoin Exploit
Coinkite has issued a major security update for Coldcard hardware wallets after a seed-generation flaw led to more than $100 million in Bitcoin thefts. Users of Coldcard Mk4, Mk5, and Q were urged to upgrade to firmware 5.6.1 or 1.5.1Q. The bug, dating to 2021, produced some seeds with too little randomness, weakening private keys and making them easier to guess without physical access. On affected devices, entropy may have dropped from 128 bits to about 40 bits. The new firmware adds stronger seed-generation requirements, replaces an older backup PRNG with SHA-256 Hash_DRBG, improves hardware RNG checks, and fixes issues in transaction signing, USB handling, firmware validation, Delta Mode, and backups. It also rechecks PSBTs immediately before signing to prevent last-second transaction tampering. Customers who generated seeds on affected versions between 2021 and July 2026 were told to create new seeds on updated firmware and move funds. The investigation and law-enforcement response are ongoing.
