Coldcard Issues Critical Firmware Update After $130M Bitcoin Exploit

Coldcard's Coinkite has issued a critical security firmware update following a massive exploit that compromised thousands of Bitcoin addresses, resulting in losses estimated at over $130 million. The attack exploited weak seed generation, which allowed attackers to steal more than 1,778 BTC.

The new firmware, version 5.6.1 for Mk4 and Mk5 devices and 1.5.1Q for Q devices, adds an additional layer of security by requiring users to contribute their own randomness through at least 65 key presses with unpredictable timing, 50 physical dice rolls or 128 physical coin flips.

The update also includes new signing checks and replaces the Yasmarang backup pseudo-random generator with SHA-256 Hash_DRBG. Coinkite notes that affected users need to create a new seed and move their Bitcoin after installing the latest firmware.