Coldcard seed-generation bug raises Bitcoin theft risk for some users

Some Coldcard Mk3 owners may need to move their Bitcoin after Coinkite warned that seeds generated on Mk3 firmware 4.0.1—or later Mk3 releases—could be vulnerable. Bitcoin Core contributor instagibbs said he reproduced the weak seed on a freshly initialized Mk3. Coinkite said Mk4 and Mk5 devices are also affected on firmware versions earlier than 5.6.0, and Coldcard Q devices are affected before 1.5.0Q. The company characterized the impact on newer models as less severe but still serious, and said it plans a formal technical review to determine the root cause. Why a setup-time flaw matters Hardware wallets typically protect existing keys through secure storage, offline signing, and on-device verification. Seed generation happens before those safeguards and determines whether the wallet begins with strong key material. Seed phrases rely on entropy—the randomness used to select one outcome from an enormous set of possibilities. If randomness is weak, that space shrinks enough for an attacker to test candidate seeds, derive the associated addresses, monitor them for incoming deposits, and spend funds once a match appears. Because all addresses derived from a seed remain controlled by that seed, mitigation requires generating new keys and moving funds on-chain. Firmware updates can improve future device behavior, but they cannot change the key material that already controls older addresses. Security layers vs. this issue - Air gap: Limits key exposure over live connections, but does not help if the seed was predictable at creation. - Secure storage: Keeps a private key isolated, but cannot fix weak original key material. - Offline signing: Protects spending approvals after a seed exists, not the seed’s creation. - On-device verification: Confirms addresses and amounts on-screen, but does not prove adequate entropy. - Firmware update: Improves future setup flows, but cannot replace keys already in use. - New seed + transfer: Creates fresh key material and moves funds away from potentially weak addresses; the only complete remediation. Who faces the highest risk Coinkite outlined the clearest exposure profile as an affected Mk3-generated seed where a single signature controls the wallet, with no dice-added entropy, no BIP39 passphrase, and no multisig. In that configuration, the device’s seed generator is the sole cryptographic root protecting the funds. The company said a strong, unique BIP39 passphrase adds an independent barrier, because it derives a separate wallet from the same mnemonic and is distinct from the device PIN. That means an attacker would need both the mnemonic and the passphrase. Coinkite cautioned that short, common, patterned, quoted, or reused passphrases may be guessable, and advised migrating to a newly generated seed even if a strong passphrase was used. Multisig can reduce single-point-of-failure risk by ensuring one weak seed is not sufficient to spend when the threshold requires additional independent keys. Users can also add external entropy with dice rolls; Coinkite’s advanced guidance specifies at least 99 fair rolls when using its dice-only import flow. Coinkite also warned that these protections introduce operational risk if handled poorly: losing a passphrase can lock out the owner, weak documentation can complicate multisig recovery, and exposed dice records can reveal the replacement seed. Recommended migration process To reduce the chance that urgency creates a second loss, Coinkite advised users to verify the backup, fingerprint, and receive address, send a small test payment, and only then move the full balance. The goal is to avoid mistakes such as a mistyped address, a weak temporary wallet, or an incomplete backup. Cold storage needs ongoing maintenance Coinkite shipped the final Mk3 firmware in June 2023, while its July 2026 advisory covers seeds created by Mk3 devices from March 2021 onward. That gap highlights how cold storage can become a legacy maintenance problem: devices may be powered on infrequently, old product pages lose visibility, and users can miss manufacturer notices for months. Because a seed can outlive the device, firmware branch, and original support channels, custody systems benefit from durable alerting and repeatable migration procedures. Coinkite’s security documentation points to open code and reproducible builds as inspection tools, but noted that defects can persist until someone audits the exact code path used during seed generation. Reproducible binaries can show what code ran; they do not, by themselves, prove the quality of randomness, making independent entropy testing an important practice. What could happen next A more constructive outcome would see affected users rotate keys carefully, Coinkite publish a clear root-cause explanation, and wallet makers strengthen entropy testing and long-lived advisory channels. Broader adoption of passphrases, multisig, and independent randomness could add multiple cryptographic barriers around a single balance. A more negative path would involve dormant Mk3 wallets continuing to receive deposits to old addresses, with owners discovering the advisory through theft reports or emergency outreach. Panic transfers could trigger additional losses due to unverified addresses, weak temporary wallets, or misplaced backups, while unsupported claims tie unrelated on-chain activity to the flaw. The post A flaw in Coldcard seed generation lets attackers recreate private keys from the press of a button appeared first on CryptoSlate.