The Coldcard Vulnerability, Explained: Who's at Risk and What to Do Now

Coinkite has confirmed a firmware bug that weakened seed generation on Coldcard devices. Attackers have already exploited the flaw to steal bitcoin from affected wallets, and the exploit remains active. Coinkite and members of the broader Bitcoin security community are urging anyone with an affected seed to migrate immediately, as funds have continued to be swept in multiple waves.

Coldcard Sweep Watch: is the stolen bitcoin still sitting there?

A live chart of the 1,366.58 BTC drained from Coldcard wallets on 30 and 31 July 2026. The line extends in real time for as long as the coins are left untouched.

Coldcard Sweep Watch

If you own a Coldcard, or if a Coldcard ever generated a seed that ended up somewhere else, the details below matter directly. If you don't, they still matter, because this points at a gap that has nothing to do with which brand you chose.

Which devices are affected, and what changed

Coinkite's advisory now covers the Mk2 and Mk3 on firmware from March 2021 onward, and the Mk4, Mk5, and Q on any firmware before their most recent hotfix.

Mk2 and Mk3 devices on firmware 4.0.1 through 5.0.3 are the most exposed. Coinkite's own analysis puts the effective entropy at roughly 40 bits instead of the intended 128, a search space small enough to sweep in hours with ordinary hardware. Independent researchers report active, ongoing fund sweeps from wallets in this category.

Mk4, Mk5, and Q have a related but less severe version of the same flaw, landing around 72 bits by Coinkite's own estimate. Independent analysis puts the realistic number lower for a targeted attacker, closer to 32 bits in the worst case. Either way, it falls short of the 128-bit target.

Coinkite shipped hotfixes for every affected model on July 31: version 4.2.0 for the Mk3, 5.6.0 for the Mk4 and Mk5, and 1.5.0Q for the Q. None of these fixes repair a seed that was already generated on the old firmware; they only make new seeds, created after the update, secure.

Some security researchers, including Jameson Lopp, have reported a non-zero chance that the Mk4, Mk5, and Q hotfix fails partway and leaves the device unusable. If you decide to continue using your Coldcard after this incident, updating to the latest firmware before generating a new seed is recommended. If you have access to another trusted hardware wallet, it's generally preferable to generate your new seed there rather than relying on an in-place firmware update on your only signer.

If your immediate priority is simply moving funds to safety, you don't necessarily need to update the firmware first. The appropriate migration depends on whether you're using singlesig or multisig, which we cover in the "What to do now" section below.

No firmware update can repair a seed that was already generated with insufficient entropy. Coinkite and members of the broader Bitcoin security community are urging affected users to migrate away from affected seeds as soon as possible. The exact migration process depends on whether the seed is being used in a singlesig wallet or as part of a multisig, which we cover below.

For Mk4, Mk5, and Q devices, the latest firmware corrects seed generation going forward, but it does not make an existing affected seed safe. Only update the device if you intend to keep using it to generate a new seed. If your priority is moving funds to another wallet or signing device, a firmware update is not required first and may introduce additional risk if the update fails.

The correct migration process depends on whether the affected seed is used in singlesig or multisig. We explain the appropriate steps for each setup in the “What to do now” section below.

Why a passphrase doesn't make this safe

Coinkite's original advisory pointed to a strong BIP-39 passphrase as a way to lower risk on an affected seed. Since then, people who had a passphrase in place have still lost funds, including at least one reported case of a Mk3 drained despite a passphrase of only two words.

The math explains why. BIP-39 passphrases are hashed with a relatively small number of iterations, which makes them cheap to test once an attacker has already reconstructed the underlying weak seed. A passphrase you memorized, reused, or picked with any kind of pattern gives an attacker a manageable list to try. Only a long, randomly generated passphrase, one you couldn't recite from memory, holds up against that math, and most people's passphrases aren't built that way.

Don't treat a passphrase as your fix here. If your seed was generated on an affected device, migrate to a new seed regardless of whether a passphrase is attached to it.

Dice rolls are the one input that reliably escapes this bug, though the number people cite varies for a real reason. Coinkite says 50 private, independent rolls of a fair die supply enough entropy, about 128 bits, to clear this specific vulnerability. Getting to the full entropy a standard 24-word seed is designed for, about 256 bits, takes closer to 99 rolls.

Fewer than 50 rolls, or rolls that weren't private and independent, should be treated as affected either way.

Where multisig's protection comes from

Multisig is often described as a single upgrade: more keys, more security. That's true, but it hides an assumption worth naming.

Safety-critical engineering has a term for the fix this situation calls for: dissimilar redundancy. A backup only protects you if it fails for different reasons than the original. Aircraft flight computers are built by separate teams, on separate hardware, running separate code, so a single design flaw can't take down every backup at once.

A multisig vault built entirely from one manufacturer's devices doesn't have that property. If your vault needs two of three keys to move funds, and all three keys were generated on a Coldcard, a single flaw in Coldcard's firmware can weaken all three at once. Two of three stops meaning anything the moment two of your three keys share the same defect.

A vault built from more than one manufacturer keeps that assumption intact. A flaw in one company's code can compromise one key. It can't reach a key generated on a different company's hardware, running different code, built by a different team.

Address reuse changes your timeline

If an address in your Coldcard-linked wallet has ever been spent from, the public keys behind it are already visible on the blockchain, which puts those funds at immediate risk regardless of anything else you do next.

If you haven't spent from an address yet, you have a little more room, but the risk returns the moment you do move funds. Someone watching the mempool can replace a pending sweep transaction with a higher-fee version and claim the coins first. A high fee and a fast broadcast reduce that window, though they don't eliminate it.

One way to close that window almost entirely: submit your sweep transaction through a mining pool's direct-submission service instead of the public mempool. MARA, a large Bitcoin mining pool, opened its Slipstream service to the public for this exact situation, letting anyone send a transaction straight to their pool instead of broadcasting it where an attacker could see and outbid it. The tradeoff is speed: confirmation depends on that pool finding a block, so it can take longer than a normal high-fee broadcast, and keeping the fee reasonable rather than excessive matters.

Don't use a small test transaction from your old wallet to check that everything works before moving the rest. Any transaction from an at-risk wallet carries the same sniping exposure, test or not. Test the receiving side instead: confirm you can see funds land and recover them on the new wallet, then send the full balance from the old one as a single, careful, real transaction.

What to do now

If you're on a Mk2 or Mk3 running firmware 4.0.1 or later, and your seed wasn't generated using at least 50 private, independent dice rolls, treat it as affected. If you're on a Mk4, Mk5, or Q running firmware released before the July 31 hotfix, the same applies.

Your first priority is replacing the affected seed. The right migration depends on whether you're using a singlesig wallet or a multisig vault.

If you're using an affected singlesig wallet

Move your funds to a new wallet as soon as possible. You do not need to update the firmware just to send your funds elsewhere.

Only update to the latest firmware if you plan to continue using that Coldcard to generate a completely new seed. Otherwise, you can migrate to a different device or wallet without updating the firmware first. Be aware that some users have reported devices becoming unusable during firmware updates, so if your immediate goal is simply moving funds to safety, updating the firmware is not required.

When setting up your new wallet, generate a completely new seed, verify the wallet fingerprint and a receive address on the device screen before sending funds, and test that you can receive and recover the new wallet before transferring your full balance. Keep your old backup until you've confirmed the migration is complete, and don't destroy the compromised seed until you're certain everything is working.

If you're using multisig

Your next steps depend on your wallet.

If your signing threshold can be satisfied by affected Coldcard devices, treat the situation as urgent. The attacker may be able to reconstruct enough keys to authorize a transaction, so you should plan a careful migration immediately. Avoid broadcasting through the public mempool, don't make a test transaction from your existing vault, and consider using a private transaction relay if you're moving funds.

If your wallet contains a single affected Coldcard key, but that key alone is not enough to satisfy your signing threshold, your situation is different. Your wallet still benefits from key diversity, and this vulnerability does not immediately compromise the wallet. You should still plan to rotate that affected key and replace it with a new seed generated on secure hardware, but you don't need to rush the migration in the same way.

If you're a Casa member

If your vault includes one or more Coldcard devices, our team can help you determine the safest migration path for your specific setup, whether that means rotating a single key or rebuilding your vault. If you have questions, don't hesitate to contact us.

If you're building a new multisig vault, use this opportunity to distribute keys across multiple hardware vendors instead of relying on a single manufacturer. That's one of the most effective ways to reduce common-mode risk and eliminate single points of failure.

Watch for scams built around this news. No one from Casa will ever ask for your seed phrase or your 24 words. If someone reaches out claiming to represent Casa, ask for their verification code before acting on anything they tell you, and don't let urgency, real or manufactured, push you into skipping a verification step.

Common questions about this vulnerability

What exactly happened, in plain terms?
Think of your Bitcoin seed phrase as the string of words that "locks" your funds. For that lock to be secure, the words need to come from something as unpredictable as a coin flip. Security people call that unpredictability entropy: the more of it behind your seed, the more guesses an attacker needs before landing on yours.

Coldcard devices have a chip built to generate that unpredictability from real physical randomness. A configuration mistake in the firmware caused that chip to get skipped, and a predictable, formula-based substitute took over instead. The seed phrases this produced still looked normal, ordinary words, the right length, but the randomness behind them was far weaker than it should have been. This has been happening since 2021, without anyone noticing until now.

This is a mistake inside Coinkite's own firmware. A supply chain attack, a term some people are using, describes outside tampering with hardware or code during manufacturing or shipping. This bug is different: a configuration error written into Coinkite's own code, sitting unnoticed in an open-source project for years.

A passphrase, sometimes called a 13th or 25th word, is an extra word or phrase added on top of a seed phrase for additional protection. Coinkite initially pointed to a strong passphrase as a way to lower risk while people migrated. Real-world reports since then show that guidance doesn't hold up as well as hoped, covered in the next section.

What is vendor diversification, and why does it matter here?
Using hardware from more than one manufacturer means a flaw in one vendor's firmware, like this one, can weaken at most one key in your vault. A vault built entirely from Coldcards had no such backstop. That's the difference this event makes concrete rather than theoretical.

Does updating my Coldcard's firmware fix an existing wallet?
No. The update fixes how new seeds get created. It does nothing for a seed that already exists. You have to generate a new seed after updating and move your funds to it.

I have a multisig vault with only one Coldcard key. Am I safe?
It depends on your threshold. If your vault needs keys beyond the ones generated on Coldcards to move funds, a weakness in your Coldcard key alone doesn't compromise the vault. Replace that key when you can, but it isn't the emergency an all-Coldcard vault is.

My Coldcard-generated seed now lives on a different brand of wallet. Does that protect me?
No. The weakness comes from how the seed was originally created. Whatever holds that seed today doesn't change where it came from.

Does a BIP-39 passphrase protect me?
Not reliably. Coinkite's original guidance pointed to a strong passphrase as a way to reduce risk, but people with passphrases in place have still lost funds. A passphrase only holds up if it's long and randomly generated, never memorized or reused, and even then, migrating to a new seed is the safer move. Treat a passphrase as one layer, never as the fix.

I generated my seed with dice. Am I safe?
Fifty private, independent rolls of a fair die clears the specific risk from this bug, about 128 bits of entropy. If you want your seed to match the full entropy a standard 24-word phrase is designed for, about 256 bits, aim for at least 99 rolls instead. Either way, that process never touches the part of the firmware that's affected.

Is this happening right now, or is it a theoretical risk?
Security researchers have reported ongoing fund movements consistent with active exploitation. Treat it as live, not theoretical.

How do I know if a specific address of mine was swept?
Independent researchers have published trackers, unaffiliated with Coinkite, that list every address confirmed drained so far, including coldcardwatch.com. These are useful for checking a specific address, but they track confirmed minimums, not a complete count. Never enter a seed phrase, private key, or passphrase into any website, including a tracker like this one; legitimate tools never ask for one.

Does this affect Casa vaults?
Casa never holds enough keys on its own to move your funds, and a vault built across multiple hardware vendors means no single manufacturer's flaw can meet the signing threshold by itself. If a key in your vault was generated on an affected Coldcard, treat it the same way you'd treat a lost key: rotate it out through the normal replacement process, and the rest of your vault stays intact throughout. Our security team is reviewing vaults that include a Coldcard key and will reach out directly to anyone affected.

If you want a second opinion on your current setup, book a session with a Casa security advisor.