Coinkite’s new firmware adds manually entered entropy and stricter transaction controls to its Coldcard wallets.
Weeks after a random breach exposed Coldcard hardware wallets to over $100 million in BTC theft, Coinkite has firmware released 5.6.1 for Mk4/Mk5 devices and 1.5.1Q for the Q model. This update stems from an AI-assisted security operation that delved much deeper than the original bug.
What’s the scoop?
- Root cause: A configuration error built into Coldcard’s 2021 firmware quietly degraded its random source, so seeds were expected to carry 128 bits of entropy, sometimes delivered with as little as ~40, which was low enough that attackers could guess private keys without any physical access required.
- What has changed: New seeds must now rely on randomness that the owner provides to the hand, namely dice rolls, coin tosses, or an unpredictable series of key presses. These inputs are overlaid on the device’s hardware entropy, and a new SHA-256-based generator now saves them. Coldcard also double-checks the transaction contents just before signing, eliminating any possibility of tampering with a compromised computer after approval.
- The trap: Seeds generated between 2021 and next July are still considered burned regardless of the update. All owners from this period still need to create a new one on the patched firmware and migrate their funds if they have not already done so.
Without a bank
2773 posts
It’s time to break up with your bank and join the movement for a better world.
About the Author
