Coldcard issues firmware fix after major Bitcoin seed vulnerability

Coinkite, the Canadian company behind Coldcard hardware wallets, has released major firmware updates (versions 5.6.1 for Mk4/Mk5 and 1.5.1Q for the Q model) to address a critical seed-generation vulnerability. The flaw, which reportedly dates back to March 2021, allowed for insufficient entropy during the creation of seed phrases, making private keys predictable and susceptible to theft.

Confirmed losses from the exploit are estimated by Galaxy Research to be approximately 1,778 BTC, valued at roughly $112 million. This incident is ranked as one of the largest cryptocurrency exploits of 2026.

The new firmware implements a ‘belt-and-suspenders’ approach by requiring users to provide physical entropy during the seed creation process. Users must now perform interactive tasks, such as at least 65 unpredictable keypresses, 50 dice rolls, or 128 coin flips, which are then combined with the device’s hardware randomness.

Coinkite warns that the update does not protect existing seeds created under the vulnerable firmware. Users must generate new seeds and migrate their funds to new wallets to ensure security. The update also introduces additional safeguards for USB data handling, transaction signing, and hardware randomness testing.