Coldcard Releases Firmware Update to Fix Seed Generation Vulnerability

Hardware wallet maker Coinkite has released a new firmware update aimed at strengthening how Coldcard devices generate seed phrases, following a major exploit that resulted in significant Bitcoin losses. The company is urging all users to upgrade immediately.

What the Update Changes

The new firmware, version 5.6.1 for Coldcard Mk4 and Mk5 and 1.5.1Q for Coldcard Q, requires users to manually contribute randomness during seed creation. This can be done through at least 65 keypresses with irregular timing, 50 rolls of a six-sided die, or 128 coin flips. That input is then combined with the device’s internal randomness sources, including its secure elements and hardware random-number generator, to produce a more unpredictable seed phrase.

Existing Seeds Remain at Risk

Coinkite warned that seed phrases generated before the update stay vulnerable even after upgrading and must be replaced before moving funds.

Confirmed losses from the underlying exploit have reached 1,778 BTC, worth about $112 million, making it one of the largest crypto hacks of the year. The update also adds new safeguards around USB connections and transaction signing to prevent related attack methods.