Bitcoin News

Story: Coldcard’s Flawed Firmware Put 1,082 Bitcoin at Risk, Block Warns

By James Thorp

1 / 15

What the Firmware Actually Got Wrong. The two flaws are distinct, and both stem from randomness failures — basically the worst thing…

2 / 15

Block Told Coinkite First — Then Went Public. Block privately told Coinkite, the company that makes Coldcard, about the vulnerabilities before…

3 / 15

What Affected Users Should Do Right Now. The advice from Block is straightforward, if uncomfortable: move your funds.

4 / 15

Bitcoin self-custody just took a serious hit. Block's engineering and security teams went public with two critical firmware vulnerabilities found across multiple generations of…

5 / 15

The affected devices cover a wide range: Coldcard Mk2, Mk3, Mk4, Q, and Mk5. Block launched its investigation after reports came in of Bitcoin being remotely stolen from wallets…

6 / 15

Users with weak 25th-word passphrases are also at risk. So are some multisignature configurations.

7 / 15

The two flaws are distinct, and both stem from randomness failures — basically the worst thing that can happen in cryptographic key generation.

8 / 15

For Mk2 and Mk3, the bug was a coding error that caused wallets to generate keys using predictable values instead of truly random ones.

9 / 15

The Mk4, Q, and Mk5 models had a different but equally serious problem. The firmware was supposed to pull in entropy from a secure element during boot to strengthen randomness.

10 / 15

And here's the part that catches a lot of people off guard: moving the compromised seed phrase to a different wallet doesn't fix anything.

11 / 15

See also: Strategy Posts $8.2 Billion Q2 Loss While Adding 11% More Bitcoin

12 / 15

Block privately told Coinkite, the company that makes Coldcard, about the vulnerabilities before publishing anything. That's standard responsible disclosure practice.

13 / 15

Security engineer Clay Garrett dug into the on-chain data and found something that made the situation look worse.

14 / 15

That figure is still preliminary. Block hasn't called it final. But 695 transactions with a matching fingerprint isn't noise — it looks coordinated.

15 / 15

The advice from Block is straightforward, if uncomfortable: move your funds. Don't wait for Coinkite to issue a patch or a statement.

The Currency Analytics

Want the full story?