Coinkite has confirmed a critical security vulnerability affecting multiple Coldcard hardware wallet models that allows attackers to derive seed phrases through brute force methods. The flaw impacts wallets generated using insufficient entropy on MK2, MK3, MK4, MK5, and Q models, with approximately 1,000 BTC reportedly compromised in active exploitation.
Understanding the Vulnerability
The security issue stems from inadequate randomness during seed generation on devices configured after late 2020. Wallets remain secure only if users generated seeds using the dice roll method with at least 50 rolls. All other seed generation methods on affected devices produced predictable outputs vulnerable to computational attacks.
The vulnerability extends beyond primary wallets to include:
- Ephemeral and session keys for Clone Coldcard features
- Key Teleport functionality
- BIP 85 child seeds derived from compromised parent seeds
Coinkite has released a firmware patch addressing the entropy generation flaw, confirming that properly configured devices can continue secure operations after applying the update.
Immediate Steps for Affected Users
Security professionals and crypto custody specialists managing funds on potentially affected devices should take immediate action:
If you possess alternative hardware wallets: Transfer funds immediately to devices from different manufacturers.
For Coldcard-only users: Generate a temporary passphrase using minimum six randomly selected BIP 39 words. Verify wallet fingerprints before and after device restart, then transfer funds to the passphrase-protected wallet. This provides temporary security while establishing permanent solutions.
Without hardware wallet access: Install established software wallets like Nunchuck, Blockstream Green, or BlueWallet. For institutional holdings, utilize multisignature configurations across multiple devices to maintain security standards.
Implications for Blockchain Security Professionals
This incident underscores the critical importance of entropy verification in hardware security implementations—a key consideration for professionals in blockchain security, cryptocurrency custody, and wallet infrastructure roles. Organizations employing security engineers and DevOps specialists should prioritize reviewing entropy sources in their security architectures.
For professionals managing client assets or enterprise cryptocurrency holdings, this vulnerability demonstrates the ongoing need for defense-in-depth strategies and regular security audits of hardware components. Updated Coldcard devices remain viable tools following firmware patches and proper seed generation protocols.
