|
Getting your Trinity Audio player ready...
|
- Coldcard now requires user-supplied entropy when generating new wallet seeds.
- The latest firmware adds USB, transaction-signing and hardware RNG safeguards.
- Users with potentially exposed seeds must create new wallets and migrate funds.
Coinkite has released a major security update for its Coldcard hardware wallets, tightening how new seed phrases are generated after a vulnerability contributed to losses of more than $112 million in Bitcoin. The company says the latest firmware adds stronger entropy requirements while expanding protections around USB connections, transaction signing and hardware randomness.
The update comes as the crypto industry continues to assess the impact of the Coldcard exploit, which has become one of the largest cryptocurrency hacks of 2026.
Coldcard Firmware Requires User-Generated Entropy
Coinkite’s latest firmware, version 5.6.1 for Coldcard Mk4 and Mk5 devices and 1.5.1Q for the Coldcard Q, changes the process for generating new wallet seeds.
Users must now contribute unpredictable data themselves. The firmware accepts at least 65 keypresses made at irregular intervals, 50 rolls of a six-sided die or 128 coin flips. That information is combined with randomness generated internally by the device.
The system draws on several hardware sources, including secure elements and a hardware random-number generator. By combining independent sources, Coinkite aims to reduce the risk that a failure in any single source could make a newly generated private key predictable.
Importantly, upgrading the firmware does not repair an already compromised seed. Coinkite has urged affected users to create a new wallet and move their funds rather than assuming an update alone resolves the risk.
New Coldcard Protections Target USB and Transactions
The security changes extend beyond seed generation. The firmware introduces additional checks designed to protect users from attacks involving compromised computers and USB connections.
Before signing, the device now rechecks transaction details. Coinkite said this is intended to address a theoretical scenario in which a malicious computer could interfere with transaction data through a USB connection.
The release also adds more hardware random-number-generator checks and a boot-time test to confirm that the wallet is operating through the expected hardware path.
USB downloads are further restricted, while encrypted sessions are required in certain circumstances. Some Bitcoin signature hash modes that can leave transaction outputs changeable are also disabled by default.
Coldcard Exploit Highlights Seed Security Risks
The urgency surrounding the update stems from the scale of the Coldcard incident. Galaxy Research reported that confirmed losses had reached 1,778 BTC, worth roughly $112 million at the time of its Aug. 14 assessment.
The underlying issue involved weak seed generation. TRM Labs reported that a firmware bug dating back to March 2021 reduced the effective strength of some wallet seeds from 128 bits to 40 bits, potentially making them vulnerable to brute-force attacks without physical access.
Also Read: Bitcoin Surges as Asian Stocks Sink: 5 Key Market Signals to Watch
Security firm Coinspect has also launched Unlukey, a free tool designed to identify wallet addresses potentially associated with weak seed generation.
The latest Coldcard firmware underscores a critical lesson for hardware-wallet users: secure hardware is only as strong as its key-generation process. Coinkite’s new safeguards add multiple layers of protection, but users whose existing seeds may have been exposed still need to migrate their assets to newly generated wallets.
Disclaimer: The information in this article is for general purposes only and does not constitute financial advice. The author’s views are personal and may not reflect the views of Chain Affairs. Before making any investment decisions, you should always conduct your own research. Chain Affairs is not responsible for any financial losses.
I’m your translator between the financial Old World and the new frontier of crypto. After a career demystifying economics and markets, I enjoy elucidating crypto – from investment risks to earth-shaking potential. Let’s explore!
