Written by Zoltan Vardaistaff writerReviewed by Yohan Yunstaff editor

Written by Zoltan Vardaistaff writer

Reviewed by Yohan Yunstaff editor

Coldcard strengthens seed generation with firmware update

Latest NewsPublishedAug 21, 2026

Coinkite urged Coldcard users to generate new seed phrases, warning that existing vulnerable seeds remain unsafe despite the security upgrade.

Coinkite released a new security upgrade to strengthen seed phrase generation by requiring user-supplied entropy mixed with improved device randomness.

Coinkite revealed firmware 5.6.1 for Coldcard Mk4 and Mk5 devices and 1.5.1Q for the Coldcard Q in a Thursday blog post.

The release requires newly generated seeds to include user-supplied entropy through at least 65 keypresses with unpredictable timing, 50 rolls of a six-sided die or 128 coin flips. That input is combined with randomness from multiple device sources, including its secure elements and hardware random-number generator (RNG).

The combined randomness is used to create the wallet’s seed phrase and is intended to keep its private keys unpredictable even if one of the device’s entropy sources fails.

Coinkite told users to upgrade immediately, emphasizing that existing seed phrases remain vulnerable even after upgrading and must be replaced with new seeds before migrating funds. 

verified losses from the Coldcard exploit reached 1,778 Bitcoin (BTC), worth about $112 million, as reported by an Aug. 14 report by Galaxy Research. This makes the Coldcard hack the third-largest cryptocurrency exploit of 2026, as reported by data aggregated by DefiLlama.

Coldcard adds transaction and USB safeguards

The company’s July 31 firmware update had already fixed the seed-generation failure for newly created wallets. Thursday’s release follows three weeks of broader security review and also adds safeguards around USB data handling, transaction signing and hardware randomness.

Coinkite stated the update addresses a theoretical attack involving a compromised computer USB port by re-verifying transactions immediately before signing. The firmware also introduces additional hardware RNG checks and a boot-time test designed to verify that the wallet is using its intended hardware path.

Related: Cybersecurity firm unveils crypto phishing campaign targeting 885,000 phone numbers

Other changes restrict USB downloads to the device’s most recent output and require an encrypted session, while certain Bitcoin signature hash modes that allow transaction outputs to remain modifiable are now blocked by default.

Coinspect launches weak-seed detection tool

Other companies are also launching software to identify wallets potentially exposed by weak seed generation.

Blockchain security company Coinspect revealed Unlukey, a free public tool for identifying wallet addresses generated from weak seed phrases. The first iteration of the tool aims to reproduce known weak seed generation and check whether public addresses belong to the affected dataset, Coinspect stated in a Friday X post.

Weak seed phrase generation was one of the main vulnerabilities that led to the Coldcard exploit. TRM Labs stated that a firmware bug from March 2021 weakened seed randomness on some Coldcard wallets, reducing key strength from 128 bits to 40 bits and making them “brute-forceable without physical access.” 

Magazine: Inside the ‘fake police raid’ that forced a $1M Bitcoin transfer

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

• Cybersecurity
• Hardware Wallet
• Bitcoin Wallet
• Hackers
• Hacks
• Scams
• Seed Phrase
• Scams & Cybercrime

More on the subject

Cybersecurity firm unveils crypto phishing campaign targeting 885,000 phone numbers

22 hours ago

Zoltan Vardai

MAYAChain halts network after estimated $1.7M exploit

Aug 19, 2026

Ezra Reguerra

Alleged $165M crypto Ponzi mastermind faces US charges after Fiji deportation

Aug 18, 2026

Ezra Reguerra

Cybersecurity firm unveils crypto phishing campaign targeting 885,000 phone numbers

22 hours ago

Zoltan Vardai

MAYAChain halts network after estimated $1.7M exploit

Aug 19, 2026

Ezra Reguerra

Alleged $165M crypto Ponzi mastermind faces US charges after Fiji deportation

Aug 18, 2026

Ezra Reguerra