COLDCARD Firmware Update Fixes $114M Exploit, Introduces User-Contributed Randomness

COLDCARD has released firmware version 5.6.1 after a significant security exploit drained an estimated $114M to $116M from users' hardware wallets. The vulnerability, which had been present since March 2021, was exploited by attackers on July 30, 2026, and resulted in the theft of approximately 1,816 BTC.

The issue stemmed from a flaw in the libngu library that affected seed-generated randomness, weakening the true random number generator (TRNG) built into the hardware. This reduced entropy to around 40 bits in earlier models, such as the Mk2 and Mk3 units, and lesser reductions in later COLDCARD devices.

To address this problem, Coinkite has implemented a new approach that requires users to contribute their own physical randomness during seed generation. This involves tasks like rolling dice or performing timed keypresses, which are then mixed with the hardware's random number output to create an unpredictable seed.