Coldcard Firmware Update Enhances User Security After $100M Exploit
New security measures implemented for Coldcard wallets following a major vulnerability discovery.
1Security Vulnerability and Impact
A flaw in Coldcard's random number generator led to the theft of 594.5 BTC from 500 addresses. The vulnerability affected all seeds generated since March 2021. According to Galaxy Research, total losses exceeded $100 million, impacting over 7,300 addresses. The issue stemmed from ineffective software path disabling in the RNG system.
2New Firmware Features
Version 5.6.1 now requires physical randomness input from users before generating new seeds - demanding at least 50 dice rolls, 128 coin flips, or 65 timed key presses. The firmware verifies hardware RNG path usage during boot and halts the device if verification fails. A new microprocessor-level key press timing system provides additional entropy.
3Technical Improvements
Coinkite replaced MicroPython's Yasmarang PRNG with NIST SP 800-90A compliant SHA-256 Hash_DRBG. The new system collects full 256-bit digests from both secure elements at startup, compared to 32-bit truncation in previous versions. Additional security measures include transaction byte rechecking before signing. The device now rejects modified transactions with a 'Transaction modified' warning.
4Affected Models and Migration
The update was released as version 5.6.1 for Mk4 and Mk5 models, and 1.5.1Q for the Q model. Mk2 and Mk3 models remain unaffected. Coinkite warned that all seeds created between 2021 and July 2026 remain vulnerable, urging users to create new seeds and transfer their BTC. Existing seeds aren't secured by the update.
5Independent Audits
Coinkite published a Security Status page detailing four independent reviews, including real-device tests observing eight hardware RNG reads for seed requests and firmware rebuilds matching every signed byte. The company emphasized these checks don't constitute comprehensive firmware audits.
6Industry Impact
The incident raised concerns about hardware wallet security and highlighted user-controlled entropy concepts. Crypto security experts are questioning whether similar vulnerabilities exist in other hardware wallets. A fourth attack wave on August 3rd stole approximately 449 BTC, indicating ongoing exploitation attempts.
7Critical Steps for Users
Coldcard users must immediately update firmware and regenerate all seeds created post-2021. Physical randomness input is now mandatory for new seed generation. Additional transaction verification steps reduce USB-based attack risks. Users should review audit results on the Security Status page.
8Turning Point in Crypto Security
This event may prompt hardware wallet manufacturers to reevaluate security approaches. User-controlled entropy could become standard in future devices. The $100M loss underscores the importance of crypto asset security. The industry may see increased demands for rigorous security audits and transparency.
Original article: CryptoPotato — Coldcard Firmware Güncellemesiyle Kullanıcı Güvenliği Artırıldı