Coldcard Warns Users to Move Bitcoin After RNG Flaw Exposes Wallet Seeds

Coldcard’s advisory covers Mk3, Mk4, Q and Mk5 seeds

Coinkite’s immediate instruction is based on the date and firmware used when a seed was generated, rather than the model now in a user’s hand. The company said Mk4 and Mk5 owners need version 5.6.0 or later, while Q owners need version 1.5.0Q or later, before making a replacement seed.

The company said an affected Mk3 wallet protected by a strong, unique BIP-39 passphrase has an additional barrier, but urged those customers to migrate as soon as practical. It stressed that this is a passphrase, not the PIN used to unlock a Coldcard.

There is a limited exception for people who supplied their own private dice entropy. Coinkite said 50 to 98 independent dice rolls added at least 128 bits of entropy and 99 or more rolls added about 256 bits. Anyone who used fewer than 50 rolls, cannot verify what they did, or used an exposed roll sequence was told to migrate.

The company said a final Mk3 update is still being considered, but warned that upgrading the discontinued platform carries a risk of bricking some units. Its practical message was more immediate: do not wait for that possibility before securing a seed covered by the advisory.

That distinction is central to the incident. A new firmware image can change future random-number generation, but it cannot add unpredictability to a recovery phrase generated years ago. Moving that phrase into another wallet would also carry forward the same underlying key material.

The episode is different from the phishing and fake-app campaigns covered in our recent hardware-wallet security report. In this case, the concern is the entropy used when the wallet secret was created, not a user being tricked into handing the recovery words to a malicious site.

How the Coldcard RNG flaw reduced seed entropy

Independent researchers at Block said in a technical analysis published Thursday that Coldcard firmware could call MicroPython’s deterministic Yasmarang fallback instead of the STM32 hardware random-number generator. Block said it published early because active exploitation was under way, while adding that it had not completed empirical testing to confirm exploitability end to end.

For Mk2 and Mk3 devices running the affected v4 firmware line, Block said no cryptographic entropy was added to the relevant generator path. For later Mk4, Q and Mk5 models, its analysis said secure-element input was reduced to a 32-bit reseed, leaving at most 2^32 securely distinguished output streams once the fallback state and call history were fixed.

That is not the same as saying every wallet can be opened remotely or instantly. Block said a practical attack also depends on information or constraints around a device identifier, timing state and prior generator calls, and it did not publish a benchmark for a full wallet-seed recovery.

Still, the model illustrates why the issue is serious. A seed phrase is the master secret from which wallet keys are derived; hashing a limited family of predictable inputs can make the output look random without creating new entropy. The same distinction underlies the older Trezor recovery case we covered, though that report involved physical attacks on older hardware rather than a shared seed-generation issue.

Coinkite’s own advisory said its investigation remains ongoing and that a formal technical review will follow. Its statement and Block’s explanation align on the action users should take, even though Block described the code path in greater technical depth.

What Coldcard users should do after the warning

Users who generated a seed on affected firmware should first establish a replacement wallet on an updated Mk4, Mk5 or Q, or on another unaffected device, Coinkite said. The company recommends recording and verifying the new backup, confirming a new receive address on the device screen, then sending and checking a small test transaction before moving the remaining balance.

For an Mk3 owner with no immediate alternative, Coinkite described a temporary passphrase-protected wallet as an interim step, but emphasized careful verification. It also documented an advanced dice-only process that uses at least 99 private rolls and bypasses the affected generator path; the company cautioned that this method demands careful backup and restoration checks.

The real risk during a migration may be operational as well as technical. Rushing, entering a seed into a phone or website, confusing an original wallet with a passphrase wallet, or failing to verify an address can create a more immediate loss. Coinkite specifically tells users to keep the old backup until the full migration is confirmed.

The Crypto Fear & Greed Index stood at 28, or Fear, on July 30. That market measure cannot assess a particular wallet’s exposure, but it reflects the caution surrounding a security event that lands while Bitcoin remains below its July high.

What remains unknown is how many affected seeds are in use, how attackers may have obtained the information needed to target any specific wallet, and whether further vulnerable workflows will be documented. Coldcard’s next technical report, further firmware guidance and any confirmed on-chain attribution are the next checkpoints for customers and the wider hardware-wallet industry.