Coldcard now requires 65 key presses after seed exploit, while exposed funds still must move
Coinkite, the maker of the Coldcard Bitcoin hardware wallet, released new standard firmware on Aug. 20 that forces users to add physical randomness whenever they generate a seed.
Owners who generate a seed after installing the current fixed release can use the hardened process. Owners still relying on a seed produced by affected firmware must generate another seed and transfer the funds unless that wallet meets the dice-roll exception.
During standard seed creation, every seed combines fresh device entropy with one required human input source: at least 65 key presses made at unpredictable intervals, 50 rolls of a physical six-sided die, or 128 physical coin flips. The requirement reduces reliance on the wallet's random-number generator alone.
Coldcard's current security status recommends version 5.6.1 for Mk4 and Mk5 devices and 1.5.1Q for Q devices. The advisory's exposure list is wider and track-specific. Coinkite's official migration guidance covers Mk2 and Mk3 firmware 4.0.1 through 4.1.9; Mk4 and Mk5 standard firmware before 5.6.0 and Edge firmware before 6.6.0X; and Q standard firmware before 1.5.0Q and Edge firmware before 6.6.0QX.
Block's independent technical analysis uses a broader Mk2 and Mk3 boundary that includes version 4.0.0. Owners of that release should not treat the vendor boundary as proof of safety.
Installing fixed firmware does not change an old seed. Unless the advisory's dice exception applies, Coinkite's migration guide tells affected users to generate a genuinely new seed, verify its backup and wallet fingerprint, confirm a receiving address on the device, send a small test transaction, and then transfer every balance tied to the old seed. Cloning or restoring the wallet does not create a new seed.
Migration is not required for this RNG flaw when the user added at least 50 fair, independent and private physical die rolls through the affected workflow and never recorded or exposed the sequence. Fewer rolls, or uncertainty about those conditions, means the user should migrate.
Block traced the original defect to code that could route requests to a deterministic MicroPython fallback because a feature flag defined as zero was treated as present. Mandatory human input adds outside entropy to new standard seeds, limiting damage if device randomness fails again. It cannot retroactively add entropy to a seed that already exists.
Coldcard treats the mixed flow differently from the advanced Dice Rolls Only option. That mode excludes hardware randomness and requires 50 rolls for a 12-word seed or 99 for a 24-word seed.
The firmware package reaches signing and data paths too. It binds USB review to a staged PSBT checksum, rechecks transaction bytes before signing, blocks SIGHASH_SINGLE modes by default, restricts USB downloads to the current encrypted-session result, and validates firmware file length. It adds persistent RNG-fault stops, a boot-time hardware-RNG linkage check, more Delta Mode isolation, and active-wallet backup behavior.
The status page lists targeted source review, a real-device RNG-path test, and a reproducible build and dice-path trace, but Coldcard says they do not amount to a full audit of every fixed binary. Coinkite says some customers suffered severe losses and law enforcement is investigating, but it has not published a verified victim count or loss total.
-- Price
This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.
You may also like

Ethereum sets 2029 quantum target as Hegotá takes shape

Who Benefits from Interest Rate Hikes? Clarity Act's Failure Due to Established Interests

Important News from Last Night and This Morning (September 19 - September 20)

SEC Holds All-Day Trading Symposium! Paul Atkins: Discussing Extending US Stock Trading to 24 Hours to Align with Cryptocurrency Market

European Stock Exchanges: Tokenized Stocks Disrupt an Already Fragmented Market

Brazil blocks stablecoins from key cross-border payment rail as $1.1 trillion market faces new limits

Former Hong Kong Bank Manager Sentenced to Four Years for $1.6 Billion Fake Letters of Credit and Cryptocurrency Bribery

USDT in Wallets May Be Blocked. What to Do and How to Store Them in Russia
![[Exclusive] Controversy Over Private VIP Event for Virtual Assets... Upbit and Bithumb Claim 'Never Held'](/public-static/21_2c30f7df62.png?format=avif)
[Exclusive] Controversy Over Private VIP Event for Virtual Assets... Upbit and Bithumb Claim 'Never Held'

Ethereum co-founder Vitalik Buterin argues that local AI can protect your privacy without losing speed

XRP ETFs hit a speed bump, but big investors aren’t dumping their tokens yet

Four Central Banks in Eight Days: Bitcoin Stays Strong

The US Stock Exchange on Blockchain: 3 Points to Understand the SEC's Major Initiative

CLARITY Act needs 3 more senators and a race against the clock for a 2026 revival

Can GSTOCK Reach $25M After Its 190x BNB Chain Rally?

Delio CEO Jeong Sang-ho Found Guilty of False Reporting as a Virtual Asset Business Operator

Accelerated Crypto Tax Reform in the U.S.! Who Benefits and Who is Limited?

StablecoinX ENA lock-up ends permanently on Oct. 5

CFTC grants broker registration relief to crypto developers

Crypto’s first big tax win comes with a catch for stakers and everyday payments

RWA futures volume jumps 142-fold after crypto’s $19B wipeout

BTC on AAVE: 4 Points to Understand Custodied Collateral Lending

Economy: BoE Moves Oil, Bitcoin Rises Anyway

Historic Decision by SEC: What Does It Mean for the Crypto Sector?

Balancer Proposes Protocol Liquidation, Plans to Distribute Over $9 Million to BAL Holders

Bank of England, inflation and US employment: Thursday after the Fed

Hong Kong's New Digital Asset Blueprint: From Five-Year Plan to Policy Address

FNGuides and Populous to Launch Joint Research Report on Digital Assets

Africa's Largest IPO Begins Stablecoin Applications on Solana











