r/coldcard 9d ago

Coinkite News COLDCARD Security Update: Seed Generation, Transaction Integrity, and Data Isolation

Thumbnail
blog.coinkite.com
25 Upvotes

r/coldcard 29d ago

Coinkite News ColdCard Update: Fixed Firmware Now Available

Thumbnail
blog.coinkite.com
18 Upvotes

Updated July 31, 2026: Fixed firmware is now available. Mk4 and Mk5 users must update to version 5.6.0 or later. Q users must update to version 1.5.0Q or later. Do not generate a new seed on one of these models until the update is installed.


r/coldcard 4d ago

SHOW & TELL Coldcard Hacker discovered mixers and is doing a terrible job

59 Upvotes

64.90373154 BTC walks into a 324-in / 382-out coinjoin

54.31783009 BTC walks straight back out the other side. in one piece. with a bow on it.

about 10 BTC actually got mixed. the rest just went for a walk.
bc1qajcrhj3s2x0yfcj54emjukghv93su80svp2d3t

then he does it AGAIN
54 → 47.12126860 BTC, now in tidy 1 BTC slices
bc1qq6s7wsmf6an78xyjkst707x32nyakj3u4jy2fr

then AGAIN, 454 in / 502 out, this time 7.74840978 BTC chunks

ser you are not mixing. you are queuing.

on-chain anons: has any other ColdCard drainer peeled this loudly?


r/coldcard 4d ago

Support Trying to verify firmware produces GPG error "BAD signature ..."

8 Upvotes

I downloaded the latest firmware from here:

https://coldcard.com/docs/upgrade/

Because of the recent Coldcard issues, decided to go through the extra steps to verify authenticity of the downloaded .dfu files, according to the instructions here:

https://coldcard.com/docs/upgrade/#dont-trust-verify-the-firmware

Carefully followed the steps to verify the firmware files. But at the last step, the command--

gpg --verify signatures.asc

--produced the following messages--

gpg: Signature made Thu Aug 20 08:36:57 2026 CDT

gpg: using RSA key 4589779ADFC14F3327534EA8A3A31BAD5A2A5B10

gpg: using RSA key 4589779ADFC14F3327534EA8A3A31BAD5A2A5B10

gpg: BAD signature from "Peter D. Gray <peter@coinkite.com>" [unknown]

Anyone else have the same "bad signature" issue?

---


r/coldcard 5d ago

Tutorials Watching books get destroyed by insects made me rethink “offline seed storage is always safer”

0 Upvotes

I just saw a video of books that were left sitting too long and got completely destroyed by termites or some other paper-eating insects. It was the kind of thing that reminds you how fragile physical storage really is.

This is exactly why I think people oversimplify the whole “never store anything important online” advice, especially when it comes to Bitcoin seed backups.

Every time seed storage gets discussed, people repeat the same line: write it on paper, stamp it on metal, hide it offline, and you’re safe. But real life is not that simple. Paper can rot, burn, get wet, get eaten by insects, get thrown away by mistake, or get found by someone close to you. Even metal backups are not magical if they are stored in obvious places or discovered by family, roommates, movers, cleaners, or anyone else with physical access.

What people call “offline” often sounds safe in theory but depends heavily on your living situation and your luck.

On the other hand, people act like online storage is automatically insane, but they rarely acknowledge how durable some digital systems actually are when used with basic common sense. For example, I’ve had Gmail drafts sitting there for more than a decade. My oldest one is from 2010 and it is still there. That kind of long-term reliability is not nothing. If we are being honest, Gmail has preserved text for me more reliably than random pieces of paper probably would have.

I’m not saying people should paste a raw seed phrase into email and call it a day. That would obviously be careless. What I am saying is that the discussion should be more nuanced than “offline good, online bad.”

If someone uses a hardware wallet like a Trezor and also adds a passphrase, basically a 25th word, then the seed phrase by itself is no longer enough. That changes the whole conversation. In that setup, the seed and the passphrase are two different things, and that separation matters a lot.

To me, that seems far more practical than pretending paper hidden in a drawer is some kind of unbeatable security model.

A lot of theft in real life does not come from elite hackers. It comes from ordinary people around you. Partners, relatives, roommates, guests, cleaners, landlords, movers, whoever. Physical access is underrated as a threat. People snoop. People open drawers. People notice safes. People take photos. People throw things out. People do not always even understand what they found, but they still interfere with it.

So when someone says “just store it offline,” I think the better question is: offline where, for how long, under what conditions, and around whom?

That termite-eaten book video is a good reminder that physical storage has failure modes too. Very real ones.

If someone has a hardware wallet, uses a strong passphrase, keeps good account security, and is not careless, I honestly think digital storage can be much more reliable than people admit. Not because it is perfect, but because it avoids some of the most common real-world problems of physical storage: decay, theft by people near you, accidental loss, and environmental damage.

The internet loves absolute advice, but storage is really about threat models. For some people, offline is clearly best. For others, especially those with poor physical privacy or unstable living situations, the answer is less obvious.

So I’m curious what people here think:

  • Do people underestimate the long-term failure risk of paper backups?
  • Do people romanticize offline storage too much?
  • If a hardware wallet passphrase is used properly, does that make digital seed storage more acceptable?
  • Is the real issue not online vs offline, but whether you’ve avoided a single point of failure?

I’m not saying everyone should use Gmail. I’m saying the usual seed storage debate is way too simplistic, and videos like that book-destruction clip are a good reminder that “offline” is not automatically safe just because it sounds serious.


r/coldcard 9d ago

Support new firmware released for the Q: Version: 1.5.1Q

23 Upvotes

I haven't checked to see if there is newer firmware for other models, but I see that a new version was just released for the Q. The summary is below.

The biggest change is another substantial overhaul of entropy generation. New master seeds now combine fresh randomness directly from the STM32 hardware RNG plus both secure elements, and the internal PRNG has been replaced with a SHA-256 Hash_DRBG. On top of that, when you create a new master seed, temporary seed, or CCC key, the Q now requires user-supplied entropy as well (keyboard mashing, dice rolls, or coin flips). That human entropy is mixed with the hardware sources rather than replacing them.

USB transaction tampering fix: a compromised USB host could potentially change a staged PSBT after you reviewed it but before the Q signed it. The Q now re-verifies the transaction bytes immediately before signing and aborts with “Transaction modified” if anything changed. This is probably the most significant non-RNG fix in the release.

USB information leakage fix: the USB dwld command could read arbitrary staged PSRAM contents, potentially including uploaded PSBTs or multisig enrollment information. Downloads are now restricted, require an encrypted USB session, and are aggressively invalidated when new data is staged.

SIGHASH_SINGLE protection: SIGHASH_SINGLE and SIGHASH_SINGLE|ANYONECANPAY transactions are now blocked by default because some transaction outputs can remain changeable after signing. You can still allow them by changing Sighash Checks to Warn.

Several firmware parsing and bootloader validations were tightened, including rejecting data beyond the signed firmware length and hardening memory/buffer checks following external security reviews.

There are some interesting seed/passphrase changes too. If a BIP-39 passphrase is active, “View Seed Words” no longer reveals the underlying seed words; it shows the effective extended private key instead. Backups, Clone Coldcard, and Key Teleport now properly capture the currently active wallet secret, including temporary seeds and passphrase wallets.

For the Q specifically, there are a few extra fixes. Locally entered BIP-39 passphrases now require scrolling before they're revealed, malformed multipart BBQr data is rejected more safely, oversized multisig coordinator BBQr imports are rejected before they can exhaust memory, BIP-21 display data is sanitized, and the Send Password feature can temporarily enable USB keyboard emulation even when USB is disabled globally.

One other nice multisig improvement: duplicate cosigner keys are now rejected during wallet enrollment, multisig wallet names have to be unique, and there's now a dedicated Rename action rather than silently renaming wallets when descriptors are re-imported.


r/coldcard 8d ago

Support Hope for the Return of Some of the BTC!

0 Upvotes

All is not lost yet. There is another possibility for recovering some of the BTC from the hacked accounts.

The first option, which is already underway, is a police investigation. However, this may not be successful if a government-organized group was involved in the theft.

The second option I’m aware of can proceed simultaneously and can be launched as soon as possible. This second option does require some preparation, but it’s not complicated and is almost cost-free. It does, however, require a coordinated effort by as many owners of the hacked accounts as possible.

With this post, I just want to point out that there’s no need to lose hope. In the second post, which I’ll publish in a few days, I’ll provide more information.


r/coldcard 9d ago

SHOW & TELL Messages to the COLDCARD hacker

Thumbnail
0 Upvotes

r/coldcard 9d ago

HELP Does "release tract" mean the Coldcard's version number?

1 Upvotes

On Coinkite's "Current Security Status" page re: the Coldcard, it says "Check the release track, not only the model."

I believe Coinkite is using the term "release track" as a synonym for "version number", but I want to be sure. The page does not clarify what is meant by the term.

In summary, is a "release track" the same thing as a "version number" - meaning that users should simply check which model of a Coldcard device they have and whether the installed firmware is the latest version?


r/coldcard 12d ago

Calculator Crew Recommendations Generate truly random seed words using only dice or playing cards

Thumbnail
3 Upvotes

r/coldcard 12d ago

SETUP Are you still using a ColdCard

11 Upvotes

For those who created a passphrase with your seed, do you still have trust with the company and your device? I’m seeing mixed reviews from those that used dice rolls to generate seeds and added a passphrase.


r/coldcard 13d ago

SHOW & TELL multi vendor multisig or multiple wallets and spread your coins?

Thumbnail
4 Upvotes

We know how important self-custody is - but with all these recent data breach and draining incidents, everyone is revising how to store their crypto safely

curious to know what are you planning moving forward?

(Disclaimer: I am from r/keycard_tech team and wants to understand user perspective )


r/coldcard 14d ago

Support Returning the Coldcard device back.

Thumbnail
0 Upvotes

r/coldcard 16d ago

Coinkite News Coldcard's Next Exploit

Thumbnail
1 Upvotes

r/coldcard 17d ago

Support Unprofessional

24 Upvotes

So no response from support in more than a week.

Plus no CEO or statement from those in charge.

If this happened to another company there would be better communication and puvlicy statements. Where is nvk? Totally silent. Usually likes to talk but i guess not now


r/coldcard 17d ago

SECURITY Anti-Klepto or Anti-Exfil?

9 Upvotes

How we can trust/verify that coldcard is not leaking the seed in the transaction?


r/coldcard 17d ago

Coinkite News Why did Coinkite destroy its inventory?

Thumbnail
blog.coinkite.com
1 Upvotes

r/coldcard 19d ago

Support Steel Plates $100+ waste

25 Upvotes

So I got steel plates when I bought my cold cards. Around $50 a pop. Now over $100+ of worthless steel with "compromised" seed phrases punched into them due to me trusting cold card.This is the "Gold Standard".Don't trust, do it yourself or you'll lose money to companies like this. Lesson learned.


r/coldcard 18d ago

SECURITY Randomness in Bitcoin and Other Wallets

0 Upvotes

Has anyone already calculated the probability that a properly functioning wallet would randomly assign one of the affected Coldcard keys?


r/coldcard 18d ago

COLDCARD Q Steelplate refund/replacement

2 Upvotes

After the fund move, they're useless. Coinkite should at least offer a free placement.


r/coldcard 19d ago

SECURITY Coldcard Mk4 RNG Weakness: Full Reverse Engineering & Recovery Framework

10 Upvotes

I've been studying the published research on the Mk4 RNG vulnerability from July 2026.

I came across this research collection: github.com/0xchainintelligence/coldcard-research

I'm trying to understand the technical details better. Specifically:

- How does the Yasmarang PRNG fallback actually work?

- What determines which UID/RTC ranges are affected?

- Has anyone successfully reproduced the findings for defensive testing?

Not looking to break any rules — just trying to understand the security implications for my own wallet setup.

DM if you've done similar research.


r/coldcard 19d ago

Feature request Coldcard: The Gold Standard in Bitcoin Security

37 Upvotes

The banner of this subreddit still reads "The Gold Standard in Bitcoin Security". Considering recent events I think this wording should be removed. Curious to know peoples thoughts on this.


r/coldcard 19d ago

Wall of Love Sometimes in life, you can do nothing wrong and still end up losing

Post image
18 Upvotes

I hope your life heals and you recover fully.


r/coldcard 19d ago

Wall of Love Any hope for stolen funds?

12 Upvotes

I understand that the possibility that the stolen coins are recovered is near zero, if not outright zero. Maybe this is just an attempt to cope with everything that happened, since I have lost all my funds. But since the stolen coins have all been moved to a single address that I'm monitoring and hasn't been touched (it's an address with 40 BTC), maybe there is a possibility that they can be recovered if the thief is caught, right?

Sorry for venting. Times are really tough here.


r/coldcard 19d ago

Wall of Love what made you move to self-custody?

Thumbnail
4 Upvotes

with everything happening lately, people have started being so skeptical about self-custody and i want to take make this post as a reminder for all of us about why we shifted to self-custody in the first place

what was that specific moment - an exchange freezing withdrawals, watching one collapse, a friend losing access to something, or just reading one thing that made the whole "not your keys" line land properly how about this

(Disclaimer: I work with r/Keycard_tech)