Is my Coldcard hardware defective?

No. This is a firmware issue, not a physical hardware fault. The device's hardware random-number generator works; a build-configuration and library-guard mistake meant the seed-generation path did not use it. What matters is which firmware was running when your seed was created.

I have a BIP-39 passphrase on my seed. Am I safe?

Coinkite rates passphrase-protected seeds as minimal-risk from this flaw, because the passphrase adds secret material the attacker does not have. Ensure you mean a true BIP-39 passphrase, not the device PIN, and keep protecting it.

Does updating my firmware fix an existing seed?

No. Updating fixes future seed generation only. A seed created by vulnerable firmware stays affected. You must generate a new seed and move the funds to it.

Are Mk4, Q and Mk5 affected, or only the Mk3?

Coinkite's initial advisory called the newer models not affected based on early analysis, but the maker's own follow-up and an independent Block report show they share the underlying fallback and reach only about 72-bit effective entropy: better than the Mk3's ~40 bits but still below the 128-bit standard. A hotfix has been issued for them.

How much Bitcoin was taken?

About 594.48 BTC is confirmed in the 30 July 2026 sweep. Block researchers flagged a further 488.11 BTC in earlier transactions with a matching fingerprint, which would bring the total near 1,082.59 BTC if linked. That larger total is not yet confirmed.

Has it been proven that the sweep exploited this Coldcard flaw?

Not definitively as of 31 July 2026. The timing and technical fit are strong and multiple independent researchers reached the weak-entropy conclusion, but no public proof establishes the exact source. Treat the flaw as real and act on it regardless of the attribution question.

Can KeychainX recover my stolen Bitcoin?

No. On-chain theft is irreversible, and anyone claiming otherwise for a fee should be avoided. KeychainX can help assess whether a seed is affected and help recover access to and migrate a wallet that has not yet been drained.

The Coldcard Mk3 Entropy Flaw: How a Skipped Hardware RNG Exposed BIP39 Seeds

Reviewed 6 September 2026. KeychainX reference analysis of the manufacturer’s published incident record. This article is not an original discovery or an independent firmware audit.

Current position: Fixed releases exist for the affected COLDCARD models and release tracks. Installing firmware corrects future seed generation; it does not strengthen an existing weak seed. Check the model, release track and firmware used when the seed was created, then follow the manufacturer’s migration guidance. A device PIN and a BIP-39 passphrase are different things.

Affected firmware and fixed releases

The following minimum fixes come from the COLDCARD security status page, checked on 6 September 2026. Standard and Edge are separate release tracks.

Model and track	Affected seed-generation firmware	Minimum fixed release
Mk2 / Mk3	4.0.1 through 4.1.9 inclusive	4.2.0
Mk4 / Mk5, standard	Before 5.6.0	5.6.0
Q, standard	Before 1.5.0Q	1.5.0Q
Mk4 / Mk5, Edge	Before 6.6.0X	6.6.0X
Q, Edge	Before 6.6.0QX	6.6.0QX

The current recommended standard releases are Mk4/Mk5 5.6.2 and Q 1.5.2Q. Mk2/Mk3 4.2.0 is the final legacy release. Use the manufacturer’s current status and signed-download instructions before installing; an older Edge 6.x version is not necessarily fixed.

What owners of an affected seed should do

Use the official migration guide for your setup. The general sequence is to verify the old backup, install and verify fixed firmware, create a replacement seed, check its backup and wallet fingerprint, and verify a receiving address on the device. Send a small test transaction before transferring the remaining balance. Retain the old backup until the transfer is complete and confirmed.

Using one device requires switching carefully between the old and new wallets. The manufacturer provides a dedicated Mk2/Mk3 procedure; there is no need to generate a replacement seed on unpatched 4.1.9 firmware. Moving the same old seed into different hardware does not repair it. Do not expose seed words, private keys or passphrases to a website while assessing this issue.

Passphrases and the independent-dice exception

According to the Coinkite advisory, a strong, unique BIP-39 passphrase adds a separate barrier, but does not repair an affected seed. Such users should still migrate as soon as practical. Short, reused or uncertain passphrases should not be treated as reliable protection. A PIN is not a BIP-39 passphrase.

The advisory gives a specific exception for seeds created with at least 50 fair, independent, private dice rolls whose sequence was never recorded or exposed. If you cannot establish that those conditions applied to the final seed you used, follow the migration guidance. This exception concerns the RNG incident alone; it does not establish that a wallet is safe from every other threat.

Why weak randomness matters

A long seed phrase can still encode a predictable secret. The number of printed words does not reveal how many different seeds its generator could actually produce. If that set is small enough, someone can try candidate seeds offline and compare derived public addresses with blockchain activity. Password strength, seed entropy and device access protection are separate questions.

The build and link integration failure

Coinkite’s technical backgrounder describes the March 2021 libNgU integration routing seed generation through MicroPython’s Yasmarang PRNG instead of the intended hardware RNG. The hardware generator did not fail and activate a deliberately designed weaker mode: the wrong implementation was selected during the build/link process.

The intended hardware code was present, but that did not establish that the seed-generation call reached it. The manufacturer’s fix removes the unwanted implementation and adds a build check. The lesson for wallet engineering is to verify the actual path used to generate secrets, not just the presence of a suitable component.

What the entropy estimates mean

The backgrounder estimates about 40 bits of effective search space for Mk2/Mk3 and about 72 bits for later affected models under its stated assumptions. These are preliminary estimates, not measured recovery times or a guarantee that any individual wallet can be opened. Extra entropy in later models reduced the severity without removing them from the affected scope.

Incident attribution and loss figures

The manufacturer’s current account says attackers exploited weakened seeds offline to steal funds. This reference page does not independently attribute any individual transaction or establish a complete loss total. Early estimates circulated with different address sets and assumptions; they should not be presented as a verified KeychainX measurement.

Read the incident record with its dates

The advisory and technical backgrounder were published on 30 July 2026 and later updated. This revision replaces the earlier July-only guidance with the current release matrix and migration links. For future changes, consult those primary pages rather than relying on a cached summary or an article’s original publication date.

Other device-generated secrets

Do not infer the security of other generated secrets from a seed-only check. Review the manufacturer’s current release notes for the features you used and keep the scope of any assessment explicit. An analysis of one seed does not audit an entire device or every historical firmware function.

Multisig requires a separate migration plan

For a multisignature wallet, identify the origin of each cosigner and the signing threshold. A change to one seed can change the wallet configuration and its addresses. Use the wallet coordinator’s current instructions, verify the replacement configuration and keep the old records until migration is confirmed. This article does not provide a universal multisig rotation procedure.

What this incident establishes about AI

The incident does not, by itself, identify how an attacker discovered the flaw. Claims about the role of AI should be distinguished from reproducible technical findings. KeychainX has not verified an AI-discovery claim for this incident.

Where KeychainX can help

KeychainX works on authorized wallet-access recovery. If you are locked out of your own wallet, an assessment can help establish what material remains and whether recovery work is feasible. Recovery is case-specific and is not guaranteed. We cannot reverse a completed blockchain transaction or promise the return of stolen funds.

For help with an access problem, contact KeychainX. For related technical topics, see the research and reference directory.

Frequently asked questions

Does updating repair my existing seed?

No. Updating and migrating are different actions. Use the guidance above for an existing affected seed.

Are Mk4, Mk5 and Q outside the affected scope?

No. Check the model and release track in the fixed-release table.

Is a strong passphrase a permanent fix?

No. It adds protection but does not restore missing seed entropy. See the advisory’s migration guidance.

Is this original KeychainX security research?

No. It is a reference analysis with links to the manufacturer’s published sources. KeychainX is not affiliated with or endorsed by Coinkite.