Coldcard Issues Urgent Warning as Bitcoin Wallet Exploit Remains Active
Coldcard has issued an urgent advisory asking affected users to move their bitcoin after confirming that an ongoing security exploit remains active for certain hardware wallet models and firmware versions.
The company warned that users who have not yet taken action should migrate their funds as soon as possible by following the official guidance for their specific device. According to the advisory, the exploit has already resulted in significant losses across affected wallets.
What Happened?
The issue centers on a vulnerability found in specific versions of Coldcard firmware. According to the company, certain wallets may have generated recovery seed phrases using insufficient entropy during the setup process. Because a seed phrase is the master key to a Bitcoin wallet, predictable seed generation could allow an attacker to recreate the wallet and gain access to its funds.
Coldcard has emphasized that the vulnerability only affects certain devices and firmware versions, rather than every wallet the company has produced.
Which Wallets Are Affected?
Coldcard has provided model-specific guidance for users:
- Owners of Coldcard Mk3 devices configured on firmware 4.0.1 or later are encouraged to move their funds immediately.
- Users of Mk4, Mk5, and Coldcard Q devices running firmware versions below the latest recommended releases should update their device, generate a new wallet, and transfer their bitcoin to the new wallet.
The company also noted that wallets created using Coldcard’s optional dice-generated entropy feature are not affected by this vulnerability.
Why Seed Generation Matters
Every Bitcoin wallet begins with the creation of a recovery seed phrase. That seed becomes the cryptographic foundation of the wallet and is what allows owners to recover access if their device is lost or damaged.
Generating that seed with strong randomness is an important part of wallet security. If the randomness used during creation is weakened, it can reduce the overall security of the wallet.
Industry Perspective
The incident has renewed discussion around secure key generation within the Bitcoin ecosystem.
Security researchers have noted that the issue relates to the implementation used by the affected firmware rather than the broader concept of hardware wallets themselves. Hardware wallets remain widely used because they keep private keys offline and separate from internet-connected devices.
What Coldcard Recommends
Coldcard is encouraging affected users to:
- Check whether their device and firmware version are included in the advisory.
- Install the latest recommended firmware where applicable.
- Create a new recovery seed following the updated process.
- Transfer bitcoin from the previous wallet to the newly generated wallet.
The company also encouraged users to share the advisory with friends and family members who may own a Coldcard wallet but are less likely to see online security updates.
As with any security-related announcement, following guidance directly from the wallet manufacturer can help users determine whether their device is affected and what steps, if any, are appropriate for their particular setup.