🤓 Our NEW deep dive of the Coldcard disaster is out!
This one covers:
- The ACTUAL entropy level
- The collision risk
- The multiple sources of "entropy", and how each was triggered
It's extremely long, I couldn't review it all yet.
https://t.co/SpuPi2Sfhi
Coinkite has now confirmed the entropy bug also impacts Mk4, Mk5, and Q models. Seeds generated on a Mk3 are severely affected; seeds generated on a Mk4, Mk5, or Q are also weakened, though harder to crack.
Our recommendation: if any key in your wallet or multisig quorum came from a seed generated on a Coldcard (without dice rolls or a passphrase), replace that key and migrate funds to a new wallet. You can generate the new seed on a different vendor’s hardware, or continue with Coldcard: update to the fixed firmware first (v5.6.0+ for Mk4/Mk5, v1.5.0Q for Q), and consider the dice-roll import method (100+ rolls) for verifiable entropy.
While you prepare to migrate: if you have coins on an address you’ve previously spent from, move them to a fresh address right away. Spending reveals an address’s pubkeys on-chain, letting attackers match cracked seeds against them directly. Fresh addresses don’t have this exposure.
For our paid users: some of the platform keys used in assisted wallets were generated with a Coldcard Mk4. The platform key alone can never move funds — it sits below your wallet’s spending threshold by design — and all new assisted wallets now use platform keys not generated by Coldcard, with full 256 bits of entropy. If you also use Coldcard for your own keys without a passphrase or dice rolls, replace those keys as soon as possible. If you don’t use Coldcard, we still recommend migrating to a new wallet at your convenience, as a cautionary measure.
If you have an active assisted wallet, we’ve given you one extra assisted wallet so you can set up a new quorum and migrate your funds at no additional cost. Details in the email we’ve sent to subscribers, or reach us via in-app Chat Support.
Introducing Canvas UI, the first ever html-in-canvas component library.
Your DOM is the render target now. Real-time shaders over real, interactive UI.
24 components. React, Vue, Svelte, vanilla TS.
Free. Open source. 🧵
https://t.co/Y5ZZDNxPUX