Coldcard Security Alert: Move Your Bitcoin Now

Coinkite has issued an urgent warning for owners of Coldcard hardware wallets. A vulnerability in the seed generation process means that keys created on certain firmware versions may be predictable. Bitcoin Core contributor instagibbs successfully recreated a vulnerable seed on a newly initialized Mk3 device. This discovery suggests that funds stored on these devices might be at risk of being accessed by anyone who can guess the weak randomness used during setup.

The affected models include the Mk3, Mk4, Mk5, and the Q series, depending on the specific firmware version installed. Because the issue lies in the initial creation of the seed phrase, simply updating your firmware will not secure your existing keys. If your seed was generated using a vulnerable firmware version, the only way to fully protect your assets is to generate a fresh seed on a secure device and transfer your funds on chain to the new wallet.

While this news is concerning, not every user is at the same level of risk. Those using a strong, unique BIP 39 passphrase or a multisig setup with independent signers have additional layers of defense. However, the company strongly recommends that all users with affected devices treat their current keys as compromised. If you choose to migrate your funds, take your time to verify your new backups and receive addresses to avoid common mistakes that happen during urgent moves.

This incident highlights why hardware wallet users should always consider adding extra entropy, such as using dice rolls, when generating a new seed. It also serves as a reminder that cold storage requires ongoing maintenance. As devices age and firmware support ends, owners must remain vigilant for security notices that could affect long term holdings.