Coldcard enhances security with critical firmware update
Hardware wallet security upgrade addresses seed generation vulnerabilities
1Update Security Details
Coinkite released firmware versions 5.6.1 for Coldcard Mk4/Mk5 and 1.5.1Q for Coldcard Q. The update mandates additional entropy sources like 65 keypresses, 50 dice rolls, or 128 coin flips from users. These inputs combine with the device's hardware random number generator to create stronger seed phrases, significantly improving wallet security against brute-force attacks.
2Current Seeds Remain Vulnerable
While urging immediate updates, Coinkite warned that existing seed phrases remain at risk. Users must generate new seeds before transferring funds. Galaxy Research reported losses from the Coldcard exploit reached 1,778 BTC (approximately $112 million), making it 2026's third-largest cryptocurrency hack. The vulnerability stemmed from weakened seed generation discovered earlier this year.
3Technical Enhancements
The firmware introduces multiple security improvements including enhanced USB data handling, transaction verification processes, and additional hardware RNG checks. A new boot-time test verifies the wallet's hardware path integrity. Critical changes include re-verifying transactions immediately before signing and blocking certain modifiable Bitcoin signature hash modes by default.
4Industry Response
Blockchain security firm Coinspect launched Unlukey, a free tool identifying wallets created with weak seeds. TRM Labs revealed a March 2021 firmware bug had reduced some Coldcards' key strength from 128-bit to 40-bit, making them vulnerable to remote brute-force attacks. These developments highlight growing concerns about hardware wallet security standards across the industry.
5Vulnerability Background
The exploit primarily resulted from weakened seed generation processes. Security analysts found that certain Coldcard wallets produced predictable seeds due to insufficient entropy mixing. This flaw, present since 2021, became critical when attackers developed methods to exploit the reduced cryptographic strength, emphasizing the need for regular firmware updates in hardware security devices.
6USB Security Measures
New firmware protections include restricting USB downloads to recent outputs and requiring encrypted sessions. The update specifically addresses potential attacks through compromised USB ports by implementing additional verification layers. Certain Bitcoin signature modes that allowed transaction modification are now disabled by default, preventing potential man-in-the-middle attacks.
7Critical User Actions
Coldcard users must immediately install the firmware update and generate new seed phrases using the enhanced entropy requirements. Coinkite emphasizes that existing seeds remain compromised regardless of firmware updates. The 65+ keypress requirement ensures adequate user-supplied randomness, creating seeds resistant to known attack vectors that previously affected the devices.
8Broader Industry Impact
Ranked as 2026's third-largest crypto exploit, the Coldcard incident has prompted industry-wide hardware security reviews. Multiple companies are developing tools to detect wallets created with weak seeds. Security experts now recommend regular firmware updates for all hardware wallets and thorough verification of seed generation processes, marking a shift toward more proactive security practices in cryptocurrency storage.