Coldcard mandates physical randomness for new seeds after exploit, requiring affected users to migrate funds

Coinkite, the maker of the Coldcard Bitcoin hardware wallet, released new standard firmware on Aug. 20 that forces users to add physical randomness whenever they generate a seed.

Owners who generate a seed after installing the current fixed release can use the hardened process. Owners still relying on a seed produced by affected firmware must generate another seed and transfer the funds unless that wallet meets the dice‑roll exception.

During standard seed creation, each seed now combines fresh device entropy with a required human input: at least 65 key presses made at unpredictable intervals, 50 rolls of a physical six‑sided die, or 128 physical coin flips. This requirement reduces reliance on the wallet’s random‑number generator alone.

Coldcard’s current security advisory recommends version 5.6.1 for Mk4 and Mk5 devices and version 1.5.1Q for Q devices. Coinkite’s migration guidance covers Mk2 and Mk3 firmware 4.0.1‑4.1.9; Mk4 and Mk5 standard firmware before 5.6.0 and Edge firmware before 6.6.0X; and Q standard firmware before 1.5.0Q and Edge firmware before 6.6.0QX.

Block’s independent analysis extends the vulnerable range to Mk2 and Mk3 version 4.0.0. Owners of that release should not consider the vendor’s boundary a guarantee of safety.

Installing the fixed firmware does not alter an existing seed. Unless the dice‑roll exception applies, Coinkite’s guide tells affected users to generate a genuinely new seed, verify its backup and wallet fingerprint, confirm a receiving address on the device, send a small test transaction, and then move every balance tied to the old seed. Cloning or restoring the wallet does not create a new seed.

Migration is not required for this RNG flaw when the user added at least 50 fair, independent, and private die rolls through the affected workflow and never recorded or exposed the sequence. Fewer rolls, or uncertainty about those conditions, means the user should migrate.

Block traced the original defect to code that could route requests to a deterministic MicroPython fallback because a feature flag defined as zero was treated as present. Mandatory human input now adds external entropy to new standard seeds, limiting damage if the device’s randomness fails again. It cannot retroactively add entropy to a seed that already exists.

Coldcard treats the mixed‑flow mode differently from the advanced Dice Rolls Only option. That mode excludes hardware randomness and requires 50 rolls for a 12‑word seed or 99 rolls for a 24‑word seed.

The firmware package also secures signing and data paths. It binds USB review to a staged PSBT checksum, rechecks transaction bytes before signing, blocks SIGHASH_SINGLE modes by default, restricts USB downloads to the current encrypted‑session result, and validates firmware file length. Additional hardening includes persistent RNG‑fault stops, a boot‑time hardware‑RNG linkage check, more Delta Mode isolation, and active‑wallet backup behavior.

The status page lists targeted source reviews, a real‑device RNG‑path test, and a reproducible build and dice‑path trace, but Coldcard states these do not constitute a full audit of every fixed binary. Coinkite reports that some customers suffered severe losses and that law‑enforcement agencies are investigating; however, no verified victim count or total loss has been published.

Source link