Coldcard Firmware Update Bolsters Seed Phrase Security Amid $112M Loss

Coldcard has released a firmware update to strengthen seed phrase generation on its devices. The update, version 5.6.1 for Coldcard Mk4 and Mk5 devices and 1.5.1Q for the Coldcard Q, requires user-supplied entropy to be mixed with device randomness when generating new seeds.

The combined randomness is used to create the wallet's seed phrase, making it more unpredictable even if one of the device's entropy sources fails. Coinkite emphasized that users should upgrade immediately and replace existing seed phrases before migrating funds, as they remain vulnerable even after upgrading.

This comes after a reported 1,778 BTC ($112 million) was lost in the Coldcard exploit, making it the third-largest cryptocurrency exploit of 2026 according to DefiLlama data. The update also adds safeguards around USB data handling, transaction signing, and hardware randomness, including re-verifying transactions before signing.

Additionally, Coinspect has launched a free public tool called Unlukey to identify wallet addresses generated from weak seed phrases. This follows the revelation that weak seed phrase generation was one of the main vulnerabilities leading to the Coldcard exploit.