The Coldcard Vulnerability, Explained: Who's at Risk and What to Do Now

Coinkite has confirmed a firmware bug that weakened seed generation on Coldcard devices. Attackers have already exploited the flaw to steal bitcoin from affected wallets, and the exploit remains active. Coinkite and members of the broader Bitcoin security community are urging anyone with an affected seed to migrate immediately, as funds have continued to be swept in multiple waves.

Coldcard Sweep Watch: is the stolen bitcoin still sitting there?

A live chart of the 1,366.58 BTC drained from Coldcard wallets on 30 and 31 July 2026. The line extends in real time for as long as the coins are left untouched.

Coldcard Sweep Watch

If you own a Coldcard, or if a Coldcard ever generated a seed that ended up somewhere else, the details below matter directly. If you don't, they still matter, because this points at a gap that has nothing to do with which brand you chose.

Which devices are affected, and what changed

The bug affects how some Coldcard devices generated seed phrases. Instead of producing the full amount of randomness (entropy) expected from a Bitcoin seed, affected firmware versions generated seeds with significantly less entropy. That reduced the number of possible seeds an attacker needs to search, making it feasible to reconstruct affected seeds that should have been computationally impossible to guess. Once an attacker recovers the seed, they can derive the wallet's private keys and spend the bitcoin without ever having physical access to the device.

The severity depends on the device model and firmware version.

Mk2 and Mk3 devices on firmware 4.0.1 through 5.0.3 are the most exposed. Coinkite's own analysis puts the effective entropy at roughly 40 bits instead of the intended 128, a search space small enough to search in hours with ordinary hardware. Independent researchers have observed active, ongoing fund sweeps from wallets in this category.

Mk4, Mk5, and Q have a related but less severe version of the same flaw, landing around 72 bits by Coinkite's own estimate. Independent analysis puts the realistic number lower for a targeted attacker, closer to 32 bits in the worst case. Either way, it falls well short of the intended 128 bits of entropy.

Coinkite shipped hotfixes for every affected model on July 31: version 4.2.0 for the Mk3, 5.6.0 for the Mk4 and Mk5, and 1.5.0Q for the Q. These updates fix future seed generation, but they do not make an existing affected seed safe.

Some security researchers, including Jameson Lopp, have reported a non-zero chance that the Mk4, Mk5, and Q hotfix fails partway and leaves the device unusable. If you plan to continue using that Coldcard, updating to the latest firmware before generating a new seed is recommended. If you have access to another trusted hardware wallet, it's generally preferable to generate your new seed there rather than relying on an in-place firmware update on your only signer.

If your immediate priority is moving funds to safety, you don't necessarily need to update the firmware first. The appropriate migration depends on whether you're using singlesig or multisig, which we cover in the "What to do now" section below.

No firmware update can repair a seed that was already generated with insufficient entropy. Coinkite and members of the broader Bitcoin security community are urging affected users to migrate away from weakly generated seeds as soon as possible. The exact migration process depends on whether the seed is being used in a singlesig wallet or as part of a multisig vault, which we cover below.

Why a passphrase doesn't make this safe

Coinkite's original advisory pointed to a strong BIP-39 passphrase as a way to lower risk on an affected seed. Since then, people who had a passphrase in place have still lost funds, including at least one reported case of a Mk3 drained despite a passphrase of only two words.

The math explains why. BIP-39 passphrases are hashed with a relatively small number of iterations, which makes them cheap to test once an attacker has already reconstructed the underlying weak seed. A passphrase you memorized, reused, or picked with any kind of pattern gives an attacker a manageable list to try. Only a long, randomly generated passphrase, one you couldn't recite from memory, holds up against that math, and most people's passphrases aren't built that way.

Don't treat a passphrase as your fix here. If your seed was generated on an affected device, migrate to a new seed regardless of whether a passphrase is attached to it.

Dice rolls are the one input that reliably escapes this bug, though the number people cite varies for a real reason. Coinkite says 50 private, independent rolls of a fair die supply enough entropy, about 128 bits, to clear this specific vulnerability. Getting to the full entropy a standard 24-word seed is designed for, about 256 bits, takes closer to 99 rolls.

Fewer than 50 rolls, or rolls that weren't private and independent, should be treated as affected either way.

Where multisig's protection comes from

Multisig is often described as a single upgrade: more keys, more security. That's true, but it hides an assumption worth naming.

Safety-critical engineering has a term for the fix this situation calls for: dissimilar redundancy. A backup only protects you if it fails for different reasons than the original. Aircraft flight computers are built by separate teams, on separate hardware, running separate code, so a single design flaw can't take down every backup at once.

A multisig vault built entirely from one manufacturer's devices doesn't have that property. If your vault needs two of three keys to move funds, and all three keys were generated on a Coldcard, a single flaw in Coldcard's firmware can weaken all three at once. Two of three stops meaning anything the moment two of your three keys share the same defect.

A vault built from more than one manufacturer keeps that assumption intact. A flaw in one company's code can compromise one key. It can't reach a key generated on a different company's hardware, running different code, built by a different team.

Address reuse changes your timeline

If an address in your Coldcard-linked wallet has ever been spent from, the public keys behind it are already visible on the blockchain, which puts those funds at immediate risk regardless of anything else you do next.

If you haven't spent from an address yet, you have a little more room, but the risk returns the moment you do move funds. Someone watching the mempool can replace a pending sweep transaction with a higher-fee version and claim the coins first. A high fee and a fast broadcast reduce that window, though they don't eliminate it.

One way to close that window almost entirely: submit your sweep transaction through a mining pool's direct-submission service instead of the public mempool. MARA, a large Bitcoin mining pool, opened its Slipstream service to the public for this exact situation, letting anyone send a transaction straight to their pool instead of broadcasting it where an attacker could see and outbid it. The trade-off is speed: confirmation depends on that pool finding a block, so it can take longer than a normal high-fee broadcast, and keeping the fee reasonable rather than excessive matters.

Don't use a small test transaction from your old wallet to check that everything works before moving the rest. Any transaction from an at-risk wallet carries the same sniping exposure, test or not. Test the receiving side instead: confirm you can see funds land and recover them on the new wallet, then send the full balance from the old one as a single, careful, real transaction.

What to do now

If you're on a Mk2 or Mk3 running firmware 4.0.1 or later, and your seed wasn't generated using at least 50 private, independent dice rolls, treat it as compromised. If you're on a Mk4, Mk5, or Q running firmware released before the July 31 hotfix, the same applies.

Your first priority is replacing the affected seed. The right migration depends on whether you're using a singlesig wallet or a multisig vault.

If you're using an affected singlesig wallet

Move your funds to a new wallet as soon as possible. You do not need to update the firmware just to send your funds elsewhere.

Only update to the latest firmware if you plan to continue using that Coldcard to generate a completely new seed. Otherwise, you can migrate to a different device or wallet without updating the firmware first. Be aware that some users have reported devices becoming unusable during firmware updates, so if your immediate goal is simply moving funds to safety, updating the firmware is not required.

When setting up your new wallet, generate a completely new seed, verify the wallet fingerprint and a receive address on the device screen before sending funds, and test that you can receive and recover the new wallet before transferring your full balance. Keep your old backup until you've confirmed the migration is complete, and don't destroy the compromised seed until you're certain everything is working.

If you're using multisig

Your next steps depend on your vault. This guidance applies whether you're using a DIY multisig setup or a Casa Vault.

If your signing threshold cannot be satisfied by affected Coldcard devices (for example, you have a single compromised Coldcard key alongside keys from other manufacturers), your funds are not exposed to this vulnerability in the same way. You should still plan to rotate the affected key and replace it with a newly generated seed, but this doesn't require the same level of urgency.

If your signing threshold can be satisfied by affected Coldcard devices, treat the situation as urgent. An attacker may be able to reconstruct enough keys to authorize a transaction, so your migration should be planned carefully.

Do not broadcast your migration transaction to the public mempool. Likewise, don't make a test transaction from your existing vault. Instead, prepare your new vault first and migrate your funds using a trusted private transaction relay, such as MARA Slipstream.

Casa Members: If your vault contains affected Coldcard keys, contact our advisor team before moving funds. We'll help determine the safest migration path for your specific vault and, where appropriate, coordinate a private broadcast through MARA Slipstream rather than the public mempool.

Watch for scams built around this news. No one from Casa will ever ask for your seed phrase. If someone reaches out claiming to represent Casa, ask for their verification code before acting on anything they tell you, and don't let urgency, real or manufactured, push you into skipping a verification step.

Common questions about this vulnerability

What exactly happened, in plain terms?
Think of your Bitcoin seed phrase as the string of words that "locks" your funds. For that lock to be secure, the words need to come from something as unpredictable as a coin flip. Security people call that unpredictability entropy: the more of it behind your seed, the more guesses an attacker needs before landing on yours.

Coldcard devices have a chip built to generate that unpredictability from real physical randomness. A configuration mistake in the firmware caused that chip to get skipped, and a predictable, formula-based substitute took over instead. The seed phrases this produced still looked normal, ordinary words, the right length, but the randomness behind them was far weaker than it should have been. This has been happening since 2021, without anyone noticing until now.

This is a mistake inside Coinkite's own firmware. A supply chain attack, a term some people are using, describes outside tampering with hardware or code during manufacturing or shipping. This bug is different: a configuration error written into Coinkite's own code, sitting unnoticed in an open-source project for years.

A passphrase, sometimes called a 13th or 25th word, is an extra word or phrase added on top of a seed phrase for additional protection. Coinkite initially pointed to a strong passphrase as a way to lower risk while people migrated. Real-world reports since then show that guidance doesn't hold up as well as hoped, covered in the next section.

What is vendor diversification, and why does it matter here?
Using hardware from more than one manufacturer means a flaw in one vendor's firmware, like this one, can weaken at most one key in your vault. A vault built entirely from Coldcards had no such backstop. That's the difference this event makes concrete rather than theoretical.

Does updating my Coldcard's firmware fix an existing wallet?
No. The update fixes how new seeds get created. It does nothing for a seed that already exists. You have to generate a new seed after updating and move your funds to it.

I have a multisig vault with only one Coldcard key. Am I safe?
It depends on your threshold. If your vault needs keys beyond the ones generated on Coldcards to move funds, a weakness in your Coldcard key alone doesn't compromise the vault. Replace that key when you can, but it isn't the emergency an all-Coldcard vault is.

My Coldcard-generated seed now lives on a different brand of wallet. Does that protect me?
No. The weakness comes from how the seed was originally created. Whatever holds that seed today doesn't change where it came from.

Does a BIP-39 passphrase protect me?
Not reliably. Coinkite's original guidance pointed to a strong passphrase as a way to reduce risk, but people with passphrases in place have still lost funds. A passphrase only holds up if it's long and randomly generated, never memorized or reused, and even then, migrating to a new seed is the safer move. Treat a passphrase as one layer, never as the fix.

I generated my seed with dice. Am I safe?
Fifty private, independent rolls of a fair die clears the specific risk from this bug, about 128 bits of entropy. If you want your seed to match the full entropy a standard 24-word phrase is designed for, about 256 bits, aim for at least 99 rolls instead. Either way, that process never touches the part of the firmware that's affected.

Is this happening right now, or is it a theoretical risk?
Security researchers have reported ongoing fund movements consistent with active exploitation. Treat it as live, not theoretical.

How do I know if a specific address of mine was swept?
Independent researchers have published trackers, unaffiliated with Coinkite, that list every address confirmed drained so far, including coldcardwatch.com. These are useful for checking a specific address, but they track confirmed minimums, not a complete count. Never enter a seed phrase, private key, or passphrase into any website, including a tracker like this one; legitimate tools never ask for one.

Does this affect Casa vaults?
It depends on how your vault is configured.

Casa Vaults are designed to reduce single points of failure by encouraging key diversity across multiple hardware manufacturers. If your vault contains a single affected Coldcard key, but your signing threshold cannot be met using affected Coldcard devices alone, this vulnerability does not immediately put your funds at risk. You should still plan to rotate the affected key and replace it with a newly generated seed.

If you're unsure how your vault is configured or what steps apply to you, contact our advisor team before anything.

What if my Casa Vault has a Coldcard quorum?

If your vault's signing threshold can be satisfied by affected Coldcard devices, you should treat the situation as urgent.

Do not broadcast your migration transaction to the public mempool. An attacker monitoring the mempool may be able to replace your transaction before it's confirmed. Likewise, don't make a test transaction from your existing vault, as it carries the same risk.

Instead, prepare your new vault first and migrate your funds using a trusted private transaction relay such as MARA Slipstream.

If you're a Casa member, our advisor team will guide you through the migration process, including helping you safely broadcast your transaction and replace the affected keys.

We're working diligently to help our clients navigate this situation safely and will continue supporting the broader Bitcoin community however we can.

If you're not a Casa member and are moving off an affected Coldcard setup, we're also offering free security consultations to help you evaluate your options and migrate safely.

If you're a Casa member or have any questions or concerns about your setup, don't hesitate to reach out through our official support channels.