The Death of Bitcoin Self-Custody — What Happens After COLDCARD? | Zach Herbert, Michael Tanguma, Josh Groth
Rob Wallace | Bitcoin NewsEMERGENCY: Your COLDCARD Seed May Be Broken. Here Is What To Do
Coinkite has disclosed a firmware bug that caused COLDCARD hardware wallets to generate seed phrases without proper randomness. Roughly 594 BTC, about 38 million dollars, was swept from nearly 500 wallets in a handful of blocks. If you generated a seed on a COLDCARD, act before you finish watching.
The most important thing to understand: the firmware hotfix protects new seeds only. It does not repair a seed that was already created on vulnerable firmware. Updating your device does not make you safe. Migrating to a new seed does.
WHO IS AFFECTED
COLDCARD Mk3 running firmware 4.0.1 through 5.0.3: Coinkite estimates the effective search space at roughly 40 bits instead of the intended 128. Treat these seeds as at risk and migrate now.
COLDCARD Mk4, Mk5, and Q: additional entropy from the secure elements put these at roughly 72 bits, better than Mk3 but still below the 128-bit target. Coinkite advises updating to firmware 5.6.0 (Mk4 and Mk5) or 1.5.0Q (Q), then generating a completely new seed.
Seeds protected by a strong, unique BIP-39 passphrase, or created with at least 99 independent dice rolls, are at minimal risk according to Coinkite's early analysis.
TAPSIGNER, OPENDIME, and SATSCARD are not affected. They use a different codebase.
IMPORTANT
Coinkite has not confirmed that the on-chain sweep was caused by this bug. Researchers consider it the most plausible explanation, and the investigation is ongoing. No COLDCARD device was physically breached, no PIN was defeated, and no secure element was broken. This is a seed generation flaw.
Never enter your seed phrase into any website or tool claiming to check whether you are vulnerable. Expect scam checkers to appear. Migrate calmly, verify your wallet fingerprint, and send a small test transaction before moving the rest.
OFFICIAL SOURCES
Coinkite Mk3 advisory: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/
Coinkite technical backgrounder: https://blog.coinkite.com/entropy-technical-backgrounder/
Firmware downloads: https://coldcard.com/docs/upgrade
GUESTS
Josh of Nova Sapiens
Michael of OnRamp
Zach of Foundation Devices