Coldcard Releases Security Update Amid Seed-Generation Defect

Coldcard has released a security update to mitigate a seed-generation defect that affected Bitcoin users. The issue arose during a 2021 code migration when seed generation switched from using Coldcard's hardware random-number generator to a software pseudo-random-number generator.

This resulted in insufficient randomness in some seeds, with estimates suggesting that affected Mk2 and Mk3 seeds had an effective search space of about 40 bits, while later models received extra entropy from secure elements, raising the preliminary estimate to around 72 bits. Neither met Coldcard's 128-bit target.

The company recommends that users verify their firmware version, create a replacement seed, and transfer their balance to a new address derived from it. The update also introduces new security controls, including requiring user-generated randomness for seed creation and verifying the SHA-256 hash and signed signatures.txt file when updating firmware.