Coldcard hardware wallet adds mandatory user randomness in seed generation and patches security issues following a $130M Bitcoin exploit.
Security & Exploits ·
Coinkite has released updated firmware for its Coldcard Bitcoin hardware wallets following a seed-generation vulnerability that led to approximately $130 million in stolen Bitcoin. The flaw, which dated to 2021, generated some wallet seeds with insufficient randomness, enabling attackers to derive private keys without physical access to the devices. By mid-August, more than 1,778 BTC had been stolen across multiple coordinated attack waves targeting roughly 4,585 addresses.
The new firmware version 5.6.1 (or 1.5.1Q for the Coldcard Q model) addresses the core vulnerability by requiring users to introduce their own randomness during seed creation through key presses, dice rolls, or coin flips, which the device then combines with its internal randomness source. Coinkite also reported fixing additional issues identified during a three-week security review involving outside researchers, including problems with transaction signing, USB data handling, firmware validation, and wallet backups. The company replaced its random-number generator and implemented checks to detect hardware failures.
All users who may have generated seeds on affected firmware versions between 2021 and July 2026 must create new seeds using the patched firmware and transfer their Bitcoin to fresh wallets. The flaw underscored broader concerns about entropy generation in hardware wallet design, as affected devices' security degraded from 128 bits of entropy to approximately 40 bits on some units.