Coinkite pushed a Coldcard firmware update Thursday, closing out a three-week security review triggered by a bitcoin theft that Galaxy Research valued at 1,778 BTC, roughly $112 million. DefiLlama ranked it the third-largest cryptocurrency exploit of 2026.
Install the new firmware now. That is the company’s message. But a warning came with it: updating does not rescue an already-compromised wallet. Seed phrases generated on vulnerable firmware remain exposed after the upgrade. Users need to generate new seeds on patched devices and move their funds.
The vulnerability had been sitting in Coldcard firmware for about five years. TRM Labs, in a report cited by Cointelegraph, said a bug introduced in March 2021 “weakened seed randomness on some Coldcard wallets, reducing key strength from 128 bits to 40 bits and making them ‘brute-forceable without physical access.'” Commodity hardware can crack a 40-bit key in hours. A properly random 128-bit key would take centuries.
Anyone holding a seed created on the affected firmware was, in practical terms, carrying a padlock a determined attacker could pick over a weekend.
The new release is firmware 5.6.1 for the Mk4 and Mk5 and 1.5.1Q for the Coldcard Q. It requires users to supply their own entropy when generating new seeds: at least 65 keypresses with unpredictable timing, 50 rolls of a six-sided die, or 128 coin flips. That input gets mixed with randomness drawn from the device’s secure elements and hardware RNG. Coinkite’s July 31 update had already closed the seed-generation flaw for newly created wallets. Thursday’s release follows a broader audit that added safeguards around USB data handling, transaction signing, and hardware randomness.
Certain Bitcoin signature hash modes are now blocked. Those modes had allowed transaction outputs to stay modifiable after signing. USB downloads are restricted to the device’s most recent output. Transactions get re-verified immediately before signing, closing a theoretical attack path through a compromised USB port. A boot-time test also now checks that the wallet is running on its intended hardware path.
The flaw traces back to a 2021 rewrite that stripped out GPL-derived code from Trezor, the first hardware wallet, and replaced trezor-crypto with a library called libngu. Bitcoin Magazine reported that libngu drew minimal external scrutiny: seven GitHub stars and fewer than 20 forks across more than five years of production use. Trezor-crypto had 512 stars and 212 forks. The Commons Clause license under which Coldcard ships its firmware is not open source by its own maintainers’ definition. The clause’s FAQ states plainly: “Is this ‘Open Source’? No.” It removes the right to sell the software to third parties.
A long-time open-source Bitcoin developer summed it up for Bitcoin Magazine: “Using mocks and stubs of Open Source code in tests is irresponsible and shortsighted. Open Source code is considered safe because anyone can verify it. If you aren’t willing to do the bare minimum of testing the features you actually depend on, then you are behaving like a leech.”
After the theft, a volunteer effort called the Bitcoin Red Team took shape. Developers including Calle and Rob Hamilton of AnchorWatch led it, with support from OpenSats. The team used frontier AI models to scan hundreds of open-source Bitcoin repositories. Thousands of findings were filed, including dozens classified as critical or high severity, across hundreds of projects. Responsible disclosures went out to maintainers before anything was published. Calle wrote on X that “literally everything they do is public, anyone can chime in.”
Blockchain security firm Coinspect released Unlukey, a free public tool for identifying wallet addresses generated from weak seed phrases. The first iteration reproduces known weak seed generation and checks whether public addresses belong to the affected dataset, the firm announced in a Friday post on X.
Galaxy Research reported that the first wave of stolen Coldcard funds still sits in a handful of addresses. The original hacker may eventually be caught. Copycat thieves were more careful. Some have stolen more bitcoin and laundered it successfully.
What remains unclear is how many users have migrated to fresh seeds since the flaw became public, and how many vulnerable wallets are still in use.
