Coldcard Discloses Five-Year Seed Generation Defect in Its Hardware Wallets

The worst kind of hardware wallet failure is not the one that leaks your key. It is the one that never gave you a good key to begin with. Coinkite, maker of the Coldcard, disclosed exactly that on 30 July.

What the vendor says happened

The device is supposed to draw the randomness behind a new seed phrase from a dedicated hardware generator. On affected units it did not. In Coinkite's own description, "a build and link integration error meant that setting did not have the intended effect, and libNgU's rng_get() symbol resolved to MicroPython's default Yasmarang implementation instead."

In plain terms: the call that was meant to reach the hardware random source silently resolved to a software pseudo-random generator built into the scripting runtime. The defect was introduced during a library migration in March 2021 and went undetected for over five years.

Affected versions, as published by the vendor:

• Mk2 and Mk3 — firmware 4.0.1 through 4.1.9
• Mk4 and Mk5 — anything before 5.6.0 (Edge before 6.6.0X)
• Q — anything before 1.5.0Q (Edge before 6.6.0QX)

The impact differs by model. On Mk4, Mk5 and Q, seeds carried roughly 72 bits of entropy in place of the intended 128. On Mk2 and Mk3, the vendor describes seeds as inadequate outright unless the user supplied at least 50 independent private dice rolls at setup — which the device has always offered, and which in this case was the difference between a sound seed and a guessable one.

The part users keep getting wrong

Updating the firmware does not repair an affected seed.

This is the sentence to read twice. Patching restores correct generation for seeds made after the update. A seed already produced under the defect remains derived from a weak number, and no amount of firmware can add entropy retroactively. The only remedy is to create a new wallet on patched firmware and move the funds.

What followed

Between 2 and 20 August, Coinkite published a run of further hardening fixes, all shipped in 5.6.1 and 1.5.1Q. The list includes callgate bounds checks, recovery from RNG errors, blocking SIGHASH_SINGLE by default, separating the secure-element check nonce from the PIN digest, validation of BIP-322 text, multisig key validation, dice-roll counting, and — notably — a staged-PSBT substitution issue that would have let a connected host rewrite a transaction after the user had reviewed it on screen.

That last one is a different class of bug from the entropy defect, and arguably as serious in practice: the whole premise of a hardware signer is that what you approve on the device is what gets signed.

On the loss figures

Coinkite has not published an amount lost. Figures in circulation — an analytics firm's estimate of roughly 116 million dollars, and a report of 594 BTC drained in a twenty-five-minute sweep on 31 July — come from third parties, not from the vendor. They may well be right. We are recording them as unconfirmed because no primary source states them, and because the size of a sweep against weak seeds is exactly the kind of number that gets repeated until it hardens.

What to do if you hold one

Check your firmware version on the device. If it predates the patched releases above, assume the seed is affected, generate a new wallet on updated firmware, and move funds to it. Do not restore the old seed onto the new firmware — the seed is the problem, not the device.

More broadly, this is the argument for supplying your own entropy at setup. The dice-roll option that made Mk2 and Mk3 seeds survivable was not a power-user affectation. It was the one control that did not depend on the vendor's build system being correct.

Sources

• Coinkite seed generation warning, 30 July 2026, updated 1 and 14 August — blog.coinkite.com
• Entropy technical backgrounder, 30 July 2026 — blog.coinkite.com
• Security update 5.6.1 and 1.5.1Q, 20 August 2026 — blog.coinkite.com
• Adding to the public record, 4 August 2026, updated 14 August — blog.coinkite.com
• Historical disclosures index — coinkite.com