Coldcard Releases Firmware Patch, Urges Users With Affected Seeds to Migrate

Security Review and Firmware Release

Coinkite released Coldcard firmware versions 5.6.1 and 1.5.1Q after a three-week internal security review that identified multiple vulnerabilities. The updates introduce mandatory user entropy during wallet seed generation, requiring users to contribute randomness when creating new keys rather than relying entirely on the device's internal randomness source.

Migration Guidance for Affected Users

Coldcard is instructing users whose seed phrases were generated with previous firmware versions to create new wallets and move their Bitcoin holdings to addresses derived from freshly generated seeds. The company did not quantify the number of affected users or provide a timeline for when migration becomes non-optional. Decrypt reported the security issues were connected to a $130 million Bitcoin exploit, though neither Coldcard's statement nor available filings specify whether customer funds were directly compromised or whether the vulnerability was discovered through external research.

Additional Vulnerabilities Patched

Beyond the entropy mechanism, the firmware update addresses additional security issues uncovered during the review. Coinkite has not detailed the nature or severity of those secondary vulnerabilities, citing standard security disclosure practices that avoid enabling attacks before users have time to update.