Coldcard firmware vulnerability exposed flawed seed generation since 2021, users urged to migrate funds immediately

Coldcard, one of the most trusted names in Bitcoin hardware wallets, has released firmware updates that patch a critical vulnerability in how its devices generate wallet seeds. The catch: updating your firmware doesn’t actually fix the problem. You still need to move your Bitcoin to an entirely new wallet. The vulnerability, which has persisted since firmware version 4.0.1 shipped in March 2021, allowed seeds to be generated with significantly reduced entropy. In English: the random number generation process that’s supposed to make your wallet’s master key essentially unguessable was, in fact, far more guessable than anyone realized. What went wrong and what’s at risk The flaw stems from faulty RNG (random number generator) processes in Coldcard’s firmware that produced predictable seed phrases. For a device whose entire value proposition is “your keys, your Bitcoin, nobody else’s,” this is about as bad as it gets. Devices affected include the Mk3, Mk4, Mk5, and Q models running firmware versions released after March 2021 and before the July 31, 2026 patch. That’s over five years of potentially compromised seed generation across Coldcard’s entire product lineup. The consequences ha...