Coldcard Users Must Add Physical Randomness to Seed Generation

Coldcard users must now add physical randomness to seed generation after a vulnerability was discovered in their Bitcoin hardware wallet. The affected firmware, which includes versions 4.0.1 through 4.1.9 for Mk2 and Mk3 devices and standard firmware before 5.6.0 and Edge firmware before 6.6.0X for Mk4 and Mk5 devices, has been fixed with a new standard firmware release on August 20.

To address the issue, users must generate a new seed using the hardened process, which combines device entropy with human input sources such as at least 65 key presses or 50 rolls of a physical six-sided die. If they had already generated a seed before installing the fixed firmware, they will need to create another seed and transfer their funds unless they meet the dice-roll exception.

Coldcard's current security status recommends version 5.6.1 for Mk4 and Mk5 devices and 1.5.1Q for Q devices. Coinkite's official migration guidance provides detailed instructions on how to update and secure their wallets.