Coldcard firmware entropy flaw may have weakened seeds; CoinKite urges urgent seed and fund migration

Security researchers and CoinKite have warned that certain Coldcard Bitcoin hardware wallet firmware versions may have generated weak or predictable seeds due to an entropy-related issue. Reports cited affected ranges including Coldcard Mk3 firmware 4.0.1 through 5.0.3, Mk4 and Mk5 devices before firmware 5.6.0, and Q devices before 1.5.0Q, with the underlying problem described as a seed-generation weakness involving the random number generator used during seed creation ^{[1] [2]}.

Multiple outlets reported that the vulnerability has been linked to theft activity, with one report stating that researchers traced the issue back to the theft of approximately 594 BTC (about $40 million at the time of reporting) and urging affected users to create new seeds and move funds as soon as possible. Another report described Coinkite’s warning that every Mk3 firmware release since version 4.0.1 may have produced vulnerable seeds, and said victims identified in the incident did not include multisig or Taproot wallets ^{[3] [2]}.

Bitcoin Magazine and other coverage framed the situation as an immediate security risk and highlighted that users should take corrective action by updating firmware (where applicable), generating new seeds, and migrating existing funds away from potentially compromised seed material ^[4].

Coldcard users in the reported affected firmware ranges are being urged to update devices, generate new seeds, and move funds promptly due to the potential for predictable seed generation tied to an entropy flaw ^[1].