Coldcard Introduces New Security Measures After Seed Exploit

Coldcard, a Bitcoin hardware wallet, has issued new standard firmware that requires users to add physical randomness when generating seeds. This change is in response to a security vulnerability that was discovered and fixed with version 5.6.1 for Mk4 and Mk5 devices and 1.5.1Q for Q devices.

Users who generated a seed on affected firmware may still be at risk, even if they update their software. To protect themselves, users should create a new seed and migrate their funds unless they meet the private exception of having added at least 50 fair, independent, and private physical die rolls through the affected workflow.

The new firmware also includes additional security features, such as binding USB review to a staged PSBT checksum and rechecking transaction bytes before signing. However, it does not retroactively add entropy to existing seeds, so users who generated their seed on affected firmware are still at risk.