Coinkite released Coldcard firmware 5.6.1 requiring manual user entropy after a $100M exploit exposed seeds generated between 2021–July 2026; users must migrate funds to new seeds.
Security & Exploits ·
Coinkite released Coldcard firmware versions 5.6.1 and 1.5.1Q requiring users to manually input randomness when generating new wallet seeds, following a flaw in the device's random number generator that exposed approximately $100M in customer funds. A build error introduced in March 2021 had routed seed generation through a software random number generator instead of the intended hardware path, reducing entropy from 128 bits to roughly 72 bits and enabling attackers to sweep 594.5 BTC from 500 addresses in July. Users whose seeds were created between 2021 and July 2026 must generate new seeds and transfer their Bitcoin, as the firmware update cannot secure already-compromised seeds; the update also includes a boot verification check and replaces the vulnerable software generator with a NIST-specified alternative seeded with 256-bit digests from both secure elements.