Urgent: Coldcard (Bitcoin Hardware Wallet) Users Need to Move Their Coins, Here’s What Happened
If you or anyone in your circle uses a Coldcard hardware wallet, please read & share this.
If you’re considering switching to Trezor
Trezor has a sale on till Aug. 6, of up to 20% off (which started before this shit show) and I got an extra 10% off, using this link.
The discount code is in this short video, yes, you’ll have to watch it:
What happened
Coinkite, the maker of Coldcard, disclosed a critical flaw in how some of its devices generate wallet seeds. In simple terms: the device was supposed to pull true randomness from a dedicated hardware chip when creating your seed phrase, but due to a coding error, it was often pulling from a much weaker, predictable source instead.
Weak randomness means a smaller pool of possible seed phrases, small enough that an attacker can potentially guess or reconstruct one and steal the funds behind it. Your PIN, your air-gapped setup, your secure element, none of that helps once the seed itself was never truly random to begin with. Sadly, researchers have already tied roughly 594 BTC (about $38 million) swept from around 500 wallets to this exact issue.
More technical explanations here:
Who is affected
Mk3 devices, seeds generated on firmware 4.0.1 through 5.0.3, are the most exposed. Coinkite estimates the effective randomness dropped to roughly 40 bits, far below what’s needed for real security.
Mk4, Mk5, and Q devices were also affected, though less severely (effective entropy around 72 bits), because some hardware-based randomness still got mixed in as a backup.
TAPSIGNER, OPENDIME, and SATSCARD are not affected, they run different code entirely.
If your seed used 50 or more independent, private dice rolls, or a strong BIP-39 passphrase, your risk is significantly lower, but migrating is still the safe move.
Coinkite’s full technical writeup is here if you want the details: Technical Deep Dive into the Entropy Issue
Coinkite’s response
Coinkite founder NVK posted a long, unusually direct apology and accountability statement. Worth reading in full:
What to do if you have a Coldcard
I’m not going to walk through the migration steps myself, this moves fast and the official guidance is the safest source to follow in real time. Go straight to Coinkite’s own instructions: blog.coinkite.com and firmware upgrade instructions. You can also follow @COLDCARDwallet and @Coinkite for real-time updates. If you’d rather be walked through it, see the video tutorial and the live support session below.
Video walkthrough
If you’d rather watch someone do this step by step, Nathan from BTC Sessions put together a quick 15-minute tutorial: confirm your seed phrase backup, upgrade firmware, wipe seed, generate a new seed from the new firmware, then migrate to the new wallet using the temp seed.
There’s also a 2+ hours support session on their Youtube channel: COLDCARD Hack Support w/ Bitcoin Mentor Team
Gabriel Custodiet also released a comprehensive guide:
Don’t throw out your old device
One more thing: don’t throw out your old device once you’ve migrated. If you ever pursue a police report or your stolen coins are recovered, your original Coldcard may be needed to prove you owned the seed, tied to the hardware ID on the processor. Because the seeds are trivially brute forceable, having the seed alone is not enough to prove you’re the rightful owner.
If you’re on a Trezor
Trezor itself confirmed its own devices are safe, and not affected by this specific issue, since it’s a Coldcard codebase problem, not a shared industry flaw:
However, if you generated your seed on an affected Coldcard and later moved that same seed onto a Trezor, you are still affected, moving a weak seed to a different device doesn’t fix the weakness:
Also:
Investigation update
Security researcher Clay Garrett shared new findings on how the attacker operated during the sweeps:
Act now
I’m so sorry for everyone who’s been hurt by this. Self custody means you’re not trusting a bank or an exchange and that you’re responsible. It doesn’t mean you’re not trusting anyone. You’re still trusting that the device’s engineering actually did what it claimed to do. Open-source firmware helped this get found fast, but it still took a live exploit for anyone to catch it.
If you have a Coldcard, don’t wait. Act now and migrate today. And if you know someone who has one and might not be following this closely, send them this article please.
P.s. Additional resources
Natalie Brunell released a good interview on the topic too:
TFTC also put together a comprehensive guide:
And James Check (Checkmatey) released a video guide too:
Connect with me:
Twitter | YouTube | Instagram | Nostr | Podcast | All other links
Latest releases:
Sponsors:
Expat Money
→ Download the free report on second citizenships & setting up a plan B in another country with Expat Money: https://expatmoney.com/efrat
Ledn
→ Access liquidity without selling your Bitcoin with Ledn — learn more at https://ledn.io/Efrat
Trezor
→ Get your TREZOR bitcoin wallet & accessories, with a 5% discount, using my code at checkout (get my code from my podcast episode - yep, you’ll have to watch it)
Abundant Mines
→ Have you tried mining bitcoin? Stack sats directly to your wallet while saving on taxes with Abundant Mines. A month of free hosting for my followers:
Special offers:
→ Get 10% off on Augmented NAC to detox the Spike protein, using the code: YCXKQDK2, and this link. (Please note, this is not medical advice and you should consult your MD). Watch the episode with Tina below.
→ Watch “New Totalitarian Order” conference with Prof. Mattias Desmet & Efrat - use code EFRAT for 10% off
— Support my work —
I was recently banned from Stripe, so I cannot have paid memberships on Substack… but there’s always another way!
.
Good write up. I would only say that I disagree with what some have said about updating the firmware of the Coldcard, because 1) it doesn't benefit you if you're burned and 2) it was created in a rush, which has its own issues.
Amazing to see you jump on this so quickly, with a solution/fix, to preserve the industry.
Maybe they needed a better Director/Chief Marketing Officer.
With broad experience personnel at the top, they very likely could have avoided this.
Might be 'curtains' for Coldcard.
You lose people's money, you'll likely lose them as a customer, forever.