NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Coldcard weak-seed flaw enables theft of more than 1,830 BTC

A Coldcard firmware flaw let thieves recover keys from weak wallet seeds. Every affected model and track now has fixed firmware, but updating cannot protect an old affected seed: create a new seed on fixed firmware and carefully move the funds.

What to do

Install official firmware for your model and track: Mk2/Mk3 4.2.0, Mk4/Mk5 standard 5.6.3, Q standard 1.5.3Q, Mk4/Mk5 Edge 6.6.1X or Q Edge 6.6.1QX. If your seed was generated on affected firmware, follow Coinkite's migration guide to create and back up a new seed, verify its address on the device, test a small transfer, then move the remaining funds; keep the old backup until everything is confirmed. Never enter seed words into a website or send them to support.

Check your devices
  • Coldcard Mk2/Mk3fixed in 4.2.0 and later
  • Coldcard Mk4/Mk5 standardfixed in 5.6.0 and later
  • Coldcard Q standardfixed in 1.5.0Q and later
  • Coldcard Mk4/Mk5 Edgefixed in 6.6.0X and later
  • Coldcard Q Edgefixed in 6.6.0QX and later

What’s happening

Attackers began stealing bitcoin on 30 July 2026 by recovering private keys from weak seeds generated by Coldcard hardware wallets. Coinkite says affected firmware covers Mk2, Mk3, Mk4, Mk5 and Q, including standard and Edge tracks. The devices themselves were not remotely taken over. Galaxy estimated losses near US$130 million by 4 August; its 16 October update counted more than 1,830 BTC from over 9,000 addresses. These remain estimates, and recovery or charges are not established by the sources reviewed as of 3 November. Released fixes cover every affected model and track, but cannot strengthen existing seeds. Owners must replace affected seeds and move funds unless Coinkite's precise independent-dice exception applies. Securely generated seeds imported from elsewhere are not weakened merely by import. A strong BIP-39 passphrase adds protection but does not remove the migration requirement. Coinkite's separate detailed technical postmortem remains pending.

What
Flaw
Affects
Coldcard Mk2, Mk3, Mk4, Mk5 and Q Bitcoin hardware wallets
Affected
Coldcard Mk2/Mk3: seeds generated on firmware 4.0.1 through 4.1.9 inclusive
Coldcard Mk4/Mk5 standard: seeds generated before firmware 5.6.0
Coldcard Q standard: seeds generated before firmware 1.5.0Q
Coldcard Mk4/Mk5 Edge: seeds generated before firmware 6.6.0X
Coldcard Q Edge: seeds generated before firmware 6.6.0QX
Exception: final seeds incorporating at least 50 fair, independent dice rolls through Add Dice Rolls, with the sequence private and unrecorded, are not considered at risk from this flaw alone
Fixed in
Coldcard Mk2/Mk3 4.2.0 or later
Coldcard Mk4/Mk5 standard 5.6.0 or later
Coldcard Q standard 1.5.0Q or later
Coldcard Mk4/Mk5 Edge 6.6.0X or later
Coldcard Q Edge 6.6.0QX or later
Since
30 July 2026
Closed
16 Oct 2026

Timeline

  1. Update

    Galaxy's later tally exceeded 1,830 BTC swept from more than 9,000 addresses, worth about US$150 million at that day's prices. This was a later estimate, rather than confirmation of a final loss total.

  2. Vendor revised

    Coinkite updated its recommended standard firmware to Mk4/Mk5 5.6.3 and Q 1.5.3Q. Its status page confirmed fixes for every affected track, while a separate detailed technical postmortem remained in preparation.

  3. Vendor revised

    Coinkite's migration guide explained how to replace affected seeds, including passphrase wallets, derived child wallets and multisignature arrangements. Copying or restoring the old seed does not resolve the problem.

  4. Update

    TRM Labs reported a different preliminary tally of approximately 1,816 BTC, valued at US$116 million, from more than 5,200 addresses. It had not attributed the thefts to a particular group.

  5. Wider attacks

    Galaxy Research tracked losses near US$130 million by this date. Its report estimated that at least 15 attackers were independently exploiting the flaw.

  6. Vendor revised

    Coinkite clarified that at least 50 fair, independent, private dice rolls added during seed creation protect against this particular flaw. A strong, unique BIP-39 passphrase adds protection but does not repair an affected seed.

  7. New fixFixed

    Coinkite released fixes across all affected tracks: Mk2/Mk3 4.2.0, Mk4/Mk5 standard 5.6.0, Q standard 1.5.0Q, Mk4/Mk5 Edge 6.6.0X and Q Edge 6.6.0QX. These correct new seed generation; existing affected seeds still require replacement.

  8. Made publicNo fix yet

    Coinkite published a warning about weak seed generation in Coldcard firmware. Attackers regenerated private keys from affected seeds and stole bitcoin without taking over the devices.

Sources

  1. Coldcard Security AdvisoryCoinkite · 30 July 2026
  2. Current COLDCARD Security StatusCoinkite · 1 Oct 2026
  3. Migrate an Affected COLDCARD SeedCoinkite · 30 Aug 2026
  4. COLDCARD All — Firmware DownloadsCoinkite · 30 Sept 2026
  5. Your Keys, Not Your Coins: Coldcard Wallets Hacked for $130m and CountingGalaxy Research · 7 Aug 2026
  6. The Largest Hardware Wallet Exploit of 2026: Inside the USD 116 Million Coldcard HackTRM Labs · 5 Aug 2026
  7. Not Your Reseller, Not Your CoinsGalaxy Research · 16 Oct 2026
  8. Wallet and exchange security watchCold Hard Sats · 2 Nov 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from July 2026 · JSON · RSS