Coldcard Firmware Update Forces User Entropy After $100M Exploit

Coldcard has released firmware update 5.6.1 to address a major security flaw in its random number generator, which allowed attackers to compromise customer funds. The defect, discovered after losses of over $100 million, was caused by a build and link error that left the device's software path enabled.

The new firmware forces users to provide their own randomness when generating new wallet seeds, using at least 50 dice rolls, 128 coin flips, or 65 timed key presses. This ensures that the seed entropy reaches the expected 128 bits. The update also verifies at boot that the random-number call reaches the intended hardware path and replaces Yasmarang with a SHA-256 Hash_DRBG.

The company notes that existing vulnerable seeds are still not safe, and users whose seeds may have been generated on affected firmware between 2021 and July 2026 should create a replacement and move their Bitcoin. The update also includes additional security checks to prevent compromised USB hosts from rewriting staged transactions.