Please treat this as urgent. Migrate your funds. Follow the advisory for your model, upgrade your device, generate a new seed, and carefully move your funds.
Help spread the word, especially to people who are less online and may not see this update.
The threat is still ongoing.
Show more
🚨 COLDCARD SECURITY UPDATE [Jul 31, 9:40 EDT]
Mk3 4.2.0 is now available.
Affected seeds without ≥50 fair, independent, private dice rolls:
👉 Mk3 4.0.1–4.1.9
👉 Mk4/Mk5 <5.6.0
👉 Q <1.5.0Q
Update first. Generate a new seed. Migrate carefully.
Show more
The first post was the advisory and what users should do.
This second post has the technical details: what actually went wrong, why our reviews missed it, the impact across Mk3/Mk4/Q/Mk5, and what we changed.
( current evaluating Mk3 firmware release )
Show more
COLDCARD Mk3 Security Advisory
If you generated a seed on a Mk3 after firmware 4.0.1, your funds may be at risk.
Mk4, Q and Mk5 are not affected based on our early analysis.
Read the advisory and migrate carefully:
Show more
Picked up a new COLDCARD Mk5?
Here’s how easy it is to securely clone your existing setup over microSD.
Seeds, multisig wallets, settings, and more transferred in seconds.
Bitcoin self-custody changes once you start thinking in terms of threat models.
Physical attacks.
Coercion.
Supply chain risks.
User mistakes.
That mindset is why COLDCARD has built so many defensive tools over the years.
Show more
It’s never been easier to broadcast a transaction.
PushTX lets you broadcast signed transactions directly from your device using NFC.
Just tap and broadcast.
@blk014 It’s when the project makers could have a “bug” in the entropy generation for later retrieval.
