A flaw in Coldcard seed generation lets attackers recreate private keys from the press of a button

Some Coldcard Mk3 owners may need to move their Bitcoin. Coinkite says funds tied to seeds generated on firmware 4.0.1 or a later Mk3 release may be at risk.

Bitcoin Core contributor instagibbs said he recreated the vulnerable seed on a newly initialized Mk3. Coinkite says Mk4 and Mk5 devices are also affected before firmware 5.6.0, while Q devices are affected before 1.5.0Q; the impact is less severe but still serious. The company plans a formal technical review of the root cause.

A hardware wallet protects an existing key through secure storage, offline signing, and on-device verification. Seed generation precedes those defenses and determines whether the device starts with strong key material.

A seed phrase draws security from entropy, the randomness that selects one combination from an immense field. Weak randomness narrows that field until an attacker can test candidate seeds, derive their addresses, and watch for deposits from another computer.

Predictable creation defeats the air gap at the starting point and turns theft into a remote search problem. An attacker can work from candidate seeds, monitor the corresponding addresses, and spend the funds once a match appears.

Because every existing address remains controlled by the original seed, remediation requires new keys and an on-chain transfer. Updated firmware can secure future setup flows, but it cannot change the key material controlling old addresses.

The highest-risk custody profile

The clearest exposure profile begins when an affected Mk3 generated the seed and one signature controls the wallet. Zero dice entropy, zero BIP-39 passphrase, and zero multisig leave the device’s seed generator as the only cryptographic root.

Coinkite says a strong, unique BIP-39 passphrase adds an independent barrier, while short, common, patterned, quoted, or reused passphrases may be guessable. The passphrase differs from the device PIN and derives a separate wallet from the same mnemonic, so an attacker must recover both secrets. Even with a strong passphrase, Coinkite advises migrating to a newly generated seed.

A multisig can confine a single weak seed to a single signer when the spending threshold requires independent keys. User-supplied dice can add an external entropy source, and Coinkite’s advanced path specifies at least 99 fair rolls through its dice-only import flow.

Those protections demand careful records and tested recovery. A lost passphrase can lock out the owner, a poorly documented multisig wallet can complicate recovery, and exposed dice records can disclose the replacement seed.

Coinkite tells users to verify the backup, fingerprint, and receive address, send a small test payment, then move the balance. That sequence limits the chance that urgency causes a second failure due to a mistyped address, a weak temporary wallet, or an incomplete backup.

Cold storage acquires a maintenance schedule

Coinkite released the final Mk3 firmware in June 2023, and its July 2026 advisory covers seeds that Mk3 devices created from March 2021 onward, placing a three-year gap between product support and an urgent custody action.

That gap turns cold storage into a legacy-maintenance problem. Dormant holders may power on a device once every few years, old product pages lose visibility, and owners may miss manufacturer notices for months.

A seed can outlive its device, firmware branch, and original support channel, so custody systems need durable alerts and repeatable migration procedures. Manufacturers can publish entropy architecture, device-specific advisories, and key-rotation playbooks that stay accessible for years beyond the final sale.

Coinkite’s security documentation describes open code and reproducible builds as inspection tools. Reviewers can compare the source with the released binaries, and defects can persist until someone studies the exact code path that generated a dormant seed.

That distinction makes independent entropy testing a core hardware-wallet practice. A reproducible binary tells a buyer which code ran, and assurance about every security assumption requires separate testing.

In the bull case, affected users rotate keys carefully, Coinkite publishes the root cause, and wallet makers adopt stronger entropy tests and durable alert channels. Passphrases, multisig, and independent randomness gain broader use, giving holders several cryptographic barriers around one balance.

In the bear case, dormant Mk3 wallets continue to receive deposits using old seeds, and owners discover the advisory through theft reports or emergency outreach. Panic transfers create extra losses through unverified addresses, weak temporary wallets or misplaced backups, and unsupported claims tie unrelated on-chain movements to the flaw.

Hardware wallets made self-custody practical by protecting keys during storage and spending.

Now, the Coldcard warning extends that security model across setup, monitoring, and rotation, turning every seed into a long-term maintenance obligation that can outlive the device that created it.