Bitcoin News
By James Thorp
1 / 15
What the Firmware Actually Got Wrong. The two flaws are distinct, and both stem from randomness failures — basically the worst thing…
2 / 15
Block Told Coinkite First — Then Went Public. Block privately told Coinkite, the company that makes Coldcard, about the vulnerabilities before…
3 / 15
What Affected Users Should Do Right Now. The advice from Block is straightforward, if uncomfortable: move your funds.
4 / 15
Bitcoin self-custody just took a serious hit. Block's engineering and security teams went public with two critical firmware vulnerabilities found across multiple generations of…
5 / 15
The affected devices cover a wide range: Coldcard Mk2, Mk3, Mk4, Q, and Mk5. Block launched its investigation after reports came in of Bitcoin being remotely stolen from wallets…
6 / 15
Users with weak 25th-word passphrases are also at risk. So are some multisignature configurations.
7 / 15
The two flaws are distinct, and both stem from randomness failures — basically the worst thing that can happen in cryptographic key generation.
8 / 15
For Mk2 and Mk3, the bug was a coding error that caused wallets to generate keys using predictable values instead of truly random ones.
9 / 15
The Mk4, Q, and Mk5 models had a different but equally serious problem. The firmware was supposed to pull in entropy from a secure element during boot to strengthen randomness.
10 / 15
And here's the part that catches a lot of people off guard: moving the compromised seed phrase to a different wallet doesn't fix anything.
11 / 15
See also: Strategy Posts $8.2 Billion Q2 Loss While Adding 11% More Bitcoin
12 / 15
Block privately told Coinkite, the company that makes Coldcard, about the vulnerabilities before publishing anything. That's standard responsible disclosure practice.
13 / 15
Security engineer Clay Garrett dug into the on-chain data and found something that made the situation look worse.
14 / 15
That figure is still preliminary. Block hasn't called it final. But 695 transactions with a matching fingerprint isn't noise — it looks coordinated.
15 / 15
The advice from Block is straightforward, if uncomfortable: move your funds. Don't wait for Coinkite to issue a patch or a statement.
The Currency Analytics
Want the full story?