Coinkite has released new firmware for its Coldcard Bitcoin hardware wallets requiring users to provide physical randomness when creating a seed, but owners whose seeds were generated by affected software may still need to move their funds.
The company, which makes the Coldcard wallet, issued the standard firmware update on 20 August. Once installed, users creating a new seed must add one of three forms of human-generated randomness: at least 65 key presses made at unpredictable intervals, 50 rolls of a physical six-sided die, or 128 physical coin flips.
The measure is intended to reduce reliance on the device’s random-number generator.
However, installing the updated firmware does not alter a seed that already exists. Coinkite’s migration guidance says users whose seed was created by affected firmware should generate a completely new seed, check its backup and wallet fingerprint, verify a receiving address on the Coldcard, send a small test transaction and then transfer all funds associated with the old seed.
Restoring or cloning an existing wallet does not generate a new seed.
The company says migration is unnecessary in one specific circumstance. Users who added at least 50 fair, independent and private physical die rolls during the affected seed-generation process do not need to move their funds, provided they never recorded or exposed the sequence of rolls.
Anyone who used fewer rolls, or is unsure whether all of those conditions were met, should migrate to a new seed.
Coldcard’s current security advice recommends firmware version 5.6.1 for Mk4 and Mk5 devices, and version 1.5.1Q for Q devices. The list of potentially exposed versions varies by model and firmware track.
Coinkite’s official guidance covers Mk2 and Mk3 firmware from 4.0.1 to 4.1.9; Mk4 and Mk5 standard firmware released before 5.6.0 and Edge firmware before 6.6.0X; and Q standard firmware before 1.5.0Q and Edge firmware before 6.6.0QX.
An independent technical analysis by Block uses a wider boundary for Mk2 and Mk3 devices, including version 4.0.0. Owners running that release should therefore not regard the vendor’s stated boundary as confirmation that their wallets are safe.
Block traced the underlying defect to code that could direct requests to a deterministic MicroPython fallback. A feature flag set to zero was treated as though it were present, allowing the fallback to be used. The newly mandatory human input supplies an additional source of entropy for future standard seeds, but cannot add randomness retrospectively to seeds already generated.
Coldcard distinguishes that standard process from its advanced “Dice Rolls Only” option. That mode excludes hardware randomness altogether and requires 50 die rolls for a 12-word seed, or 99 rolls for a 24-word seed.
The firmware update also affects signing and data-handling protections. It links USB review to a staged PSBT checksum, checks transaction bytes again before signing, blocks SIGHASH_SINGLE modes by default, limits USB downloads to the result of the current encrypted session and checks firmware file length.
Further changes include persistent stops when the random-number generator reports a fault, a boot-time check linking the hardware random-number generator, greater isolation for Delta Mode and updated behaviour for backups associated with the active wallet.
Coldcard’s status page lists a targeted review of the source code, testing of the random-number path on a real device, a reproducible build and an examination of the dice-input process. The company says those measures do not constitute a complete audit of every fixed binary.
Coinkite has said some customers suffered severe losses and that law enforcement is investigating. It has not released a verified number of victims or a total value for the losses.
Bitcoin is down 2.35% over the past 24 hours and remains the number-one cryptocurrency by market capitalisation.
The report was written by Liam Wright, also known as “Akiba”, a reporter, podcast producer and Editor-in-Chief at CryptoSlate. Wright has said he believes decentralised technology could have significant potential.
CryptoSlate says artificial-intelligence tools may support research, editing and production, while its journalism remains human-led and overseen by its editorial team. The publication says its writers’ opinions are their own and do not represent CryptoSlate, and that none of its content should be treated as investment advice. It does not endorse projects mentioned or linked in its articles.
CryptoSlate also warns that buying and trading cryptocurrencies are high-risk activities, advises readers to carry out their own research before acting on information in its articles, and accepts no responsibility for trading losses. Its full company disclaimers and AI usage disclaimer are available through the publication.
Its newsletter, “Follow the signal”, offers market-moving updates.
