🔐 The Coldcard Seed Flaw (2026) — Check Your Wallet in Three Questions

Published: 15-08-2026 · Sources verified against the manufacturer advisory · ~8 min

Is your Coldcard seed phrase at risk?

Your seed is at risk if it was generated on affected Coldcard firmware, you did not add at least 50 of your own dice rolls, and the wallet has no strong separate passphrase. A March 2021 build error disabled the hardware random number generator, leaving Mk2 and Mk3 seeds with roughly 40 bits of entropy instead of 128. Updating the firmware does not repair an existing seed.

📈 Keep long-term holdings on your own hardware. For the part you actually trade: Bybit — up to $30,000 bonus for new accounts

---

What actually happened

On 30 July 2026 bitcoin started leaving cold wallets. Not exchanges, not hot apps — devices people bought specifically so they could stop worrying. There was no hack in the usual sense: nobody guessed a password, nobody sent a phishing link, nobody touched the device. The owners did nothing wrong.

In March 2021, during a migration to a new cryptographic library, one line of build configuration went wrong. Coinkite set MICROPY_HW_ENABLE_RNG to zero, intending to disable MicroPython's software generator because Coldcard had its own hardware wrapper. But libngu's guard used #ifndef — it checked whether the macro was defined, not whether it was enabled. The build completed cleanly, and seed generation quietly resolved to MicroPython's deterministic Yasmarang fallback instead of the STM32 hardware generator.

Coinkite describes the mechanism plainly in its technical deep dive:

The hardware TRNG did not fail and trigger a weaker fallback at runtime. This was inherited platform behavior activated by a link-time error, not an intentional seed-generation design decision or shortcut.

The whole incident in five lines. libngu tests #ifndef — whether the macro exists — not whether it is enabled, so the build never fails. Source, captured 15 August 2026.

And the other half: Coldcard sets the macro to zero, with the comment «We have our own version of this code». Source, captured 15 August 2026.

The fallback was seeded from the chip's UID and timer registers — values that are fixed, observable or narrowly constrained. Not a cryptographic entropy source. For five years, seeds were being born weak and nobody noticed.

---

How bad is 40 bits, really?

It is the difference between impossible and a weekend project. Entropy is measured in bits, and each bit doubles the search space. The BIP-39 standard targets 128 bits — more combinations than there are atoms in a mountain range, unbreakable by every computer on the planet running until the sun burns out.

Forty bits is roughly a trillion possibilities. That is brute forceable on ordinary consumer hardware. Not a supercomputer, not a state actor: a desktop machine.

And the attacker never needs to know whose wallet he is breaking. He generates weak phrases in bulk, derives addresses from them, checks those addresses against the blockchain, discards the empty ones and sends a transaction to the funded ones. It is a conveyor belt, and it runs for as long as money sits on reachable addresses. That is why the thefts arrived in waves rather than all at once.

---

Which Coldcard models are affected

Coinkite's own wording on both estimates — and its own note that they are preliminary. Captured 15 August 2026.

Entropy estimates from Coinkite's technical backgrounder, which labels them preliminary. Fixed-release matrix from the COLDCARD security status page, verified 13 August 2026.

The patched releases, straight from the manufacturer — including 4.2.0 for Mk2 and Mk3, the one the table above leaves implicit. Note the line under the cards: fixed firmware corrects future seed generation, existing seeds still need migrating unless the dice exception applies. Source, captured 15 August 2026.

Block's table. The row that matters is «Mk4/Q/Mk5, successful reseed» — ≤2^32 where the attacker knows the timers, against the manufacturer's 72 bits. Captured 15 August 2026.

A caveat worth knowing. Coinkite's 72-bit figure for the newer models is its own estimate. Block's independent analysis reached a harsher conclusion: the secure-element entropy mixed in on Mk4 only reaches a 32-bit reseed, giving "at most 2^32 securely distinguished output streams". Block explicitly writes that the looser 73-bit ceiling "is not 73-bit cryptographic security". If you own a newer model, plan on migrating rather than leaning on the comfortable number.

---

The three questions that decide everything

I read both advisories and Block's teardown line by line before writing this, and the practical test comes down to three checks:

1. When was the seed created? If it was generated on a Coldcard from March 2021 until the fixed release for your model, it sits in the affected window. Seeds created before firmware 4.0.1 used the hardware generator.

2. Did you add your own dice rolls? This is the real escape hatch. On affected firmware, Coldcard hashed the device-generated seed together with every roll entered through Add Dice Rolls. Coinkite's security advisory is precise about the threshold:

50 to 98 independent, private rolls: the dice input alone contributed at least 128 bits of entropy.

The exact thresholds from the advisory — this is the block to check yourself against. Captured 15 August 2026.

If the rolls were fair, private and never recorded, the entropy came from you rather than the broken generator, and the seed is not considered at risk from this issue alone.

3. Is there a strong BIP-39 passphrase? A long, unique passphrase is a second barrier that reduced entropy alone does not cross — an attacker would have to discover it as well. Short, common, patterned or reused passphrases do not count. And note that a passphrase reduces exposure without repairing the seed; Coinkite still tells passphrase users to migrate.

One yes to the first plus two noes after it means you migrate.

---

Why updating the firmware is not enough

The patch protects the future, not the past. This is the part that costs people money, because updating feels like fixing.

A seed is generated once. Its weakness is recorded in the words themselves — the twelve or twenty-four items you wrote on paper. New firmware changes how the next seed is made and has no reach into one that already exists. The security status page states it without hedging: an update is not a seed migration.

The manufacturer states it on its own status page: the fix corrects future seed generation, it does not repair an existing seed. Captured 15 August 2026.

Coinkite's own migration guide opens with the same warning, and adds one worth repeating: never type seed words, a passphrase, dice rolls or a backup password into any website, and never send them to support. Source, captured 15 August 2026.

Here is the order that keeps a migration from becoming its own disaster:

1. Install the fixed release for your model and confirm the version on the device.
2. Generate a completely new seed on the updated Coldcard.
3. Record the backup, then verify it — plus the wallet fingerprint.
4. Verify a receive address on the device screen, not in software.
5. Send one small test transaction and confirm it arrives.
6. Only then move the remaining balance.
7. Keep the old backup until the full amount has landed and confirmed.

Coinkite's own wording deserves repeating: rushing a wallet migration can create a more immediate risk than the issue you are trying to address.

---

What about multisig?

Multisig does not save you by default, and this is widely misreported. The intuition is reasonable — several keys are needed, so one weak key should not be enough. But if every key in the arrangement was generated on affected Coldcard firmware, every key is equally guessable and the quorum falls together.

Block states it without qualification:

Even if a COLDCARD is used in a multisig arrangement, if the arrangement is composed of exclusively vulnerable devices, then the impact of the vulnerability remains. A quorum of secure devices is necessary to protect against this issue.

Multisig helps here only when enough of its keys came from devices outside this issue. If you built a 2-of-3 from three Coldcards bought together in 2022, you have one problem, not three protections.

---

The uncomfortable lesson about open source

Coldcard's firmware has been public since 2018. Anyone could read it. Reproducible builds were introduced in the very release train that carried the bug. And the flaw sat there for five years.

Coinkite's own summary is unusually candid:

The COLDCARD source code has always been open and publicly available, so we have to assume that someone used AI to review previous versions of our firmware and stumbled upon this issue. A few weeks ago, we used one of the best available AI models to review our code for security issues, and it did not find this bug or anything serious.

Openness helps. Openness is not an audit. We have spent a decade treating "open source" as a guarantee, and this is what the gap between the two looks like in practice. Existing review confirmed the correct hardware generator was present in the binary — nobody verified which implementation the seed path actually reached.

That reframes the question people ask me most. "Which hardware wallet is best" is a weak question. The strong one is: where did the randomness in my seed come from, and can I verify that myself? Independent dice entropy is the answer that does not depend on trusting any vendor's build pipeline — which is exactly why the people who used it walked away from this untouched.

---

What this does not mean

It does not mean cold storage failed. One random number generator failed, in one product line, because of one line of build configuration. The principle of holding your own keys is intact.

The sensible split has not changed: long-term holdings on your own hardware, with a seed whose entropy you can account for, and the portion you actively trade on a platform with reserves and an insurance fund. Those are different jobs and they want different tools.

If you want the mechanics walked through end to end, I recorded the full breakdown on YouTube. And if you are reassessing your setup entirely, the 2026 hardware wallet comparison covers what else is on the table, while the Bybit security checklist handles the exchange side.

📈 Open a Bybit account — up to $30,000 bonus · 🔐 Hardware wallets compared

---

Written by Maria Klimenok · CRYPTO LADY. This article contains an affiliate link to Bybit — same price for you, a small commission for me. Coldcard, Coinkite and Block are not partners and no link here is affiliated with them. Entropy figures are the manufacturer's preliminary estimates and may change as the investigation continues; the formal technical postmortem had not been published as of 13 August 2026. This article is educational and is not financial or security advice — verify your own device against the manufacturer advisory before acting.

Running a campaign and want this kind of breakdown for your product? Formats and pricing · Telegram