Coldcard Security Upgrade Strengthens Seed Phrase Generation

Coinkite released a new security upgrade to strengthen seed phrase generation by requiring user-supplied entropy mixed with improved device randomness.

Coinkite announced firmware 5.6.1 for Coldcard Mk4 and Mk5 devices and 1.5.1Q for the Coldcard Q in a Thursday blog post.

The release requires newly generated seeds to include user-supplied entropy through at least 65 keypresses with unpredictable timing, 50 rolls of a six-sided die or 128 coin flips. That input is combined with randomness from multiple device sources, including its secure elements and hardware random-number generator (RNG).

The combined randomness is used to create the wallet’s seed phrase and is intended to keep its private keys unpredictable even if one of the device’s entropy sources fails.

Coinkite told users to upgrade immediately, emphasizing that existing seed phrases remain vulnerable even after upgrading and must be replaced with new seeds before migrating funds. 

Confirmed losses from the Coldcard exploit reached 1,778 Bitcoin (BTC), worth about $112 million, according to an Aug. 14 report by Galaxy Research. This makes the Coldcard hack the third-largest cryptocurrency exploit of 2026, according to data aggregated by DefiLlama.

Coldcard adds transaction and USB safeguards

The company’s July 31 firmware update had already fixed the seed-generation failure for newly created wallets. Thursday’s release follows three weeks of broader security review and also adds safeguards around USB data handling, transaction signing and hardware randomness.

Coinkite said the update addresses a theoretical attack involving a compromised computer USB port by re-verifying transactions immediately before signing. The firmware also introduces additional hardware RNG checks and a boot-time test designed to verify that the wallet is using its intended hardware path.

Related: Cybersecurity firm unveils crypto phishing campaign targeting 885,000 phone numbers

Other changes restrict USB downloads to the device’s most recent output and require an encrypted session, while certain Bitcoin signature hash modes that allow transaction outputs to remain modifiable are now blocked by default.

Coinspect launches weak-seed detection tool

Other companies are also launching software to identify wallets potentially exposed by weak seed generation.

Blockchain security company Coinspect revealed Unlukey, a free public tool for identifying wallet addresses generated from weak seed phrases. The first iteration of the tool aims to reproduce known weak seed generation and check whether public addresses belong to the affected dataset, Coinspect said in a Friday X post.

Weak seed phrase generation was one of the main vulnerabilities that led to the Coldcard exploit. TRM Labs said that a firmware bug from March 2021 weakened seed randomness on some Coldcard wallets, reducing key strength from 128 bits to 40 bits and making them “brute-forceable without physical access.” 

Magazine: Inside the ‘fake police raid’ that forced a $1M Bitcoin transfer