Mike Bickham | COO@COLDCARD

COO @COLDCARDwallet -Global Business Leader with successful track record in Strategy, Operations, Digital and Marketing across industries. Feel free to DM

[COLDCARD @COLDCARDwallet]

If you would like us to apply our existing retention policies to your data, we will exempt them from this protocol. Please confirm that you do not want us to preserve your data by contacting support @ coinkite . com

[COLDCARD @COLDCARDwallet]

Update on Customer Data Retention

We want to inform our customers of a change to our data-handling practices in connection with the security incident disclosed on July 30, 2026.

As many of you know, our standard practice has been to automatically blank customer records after 120 days, retaining only email addresses and country of residence. We have also offered customers the option to request accelerated blanking at any time after delivery.

Due to legal obligations arising from the security incident, including the preservation of records that may be relevant to ongoing and anticipated legal proceedings, we have temporarily suspended our automated data-blanking process. This means that customer records that would otherwise have been blanked under our standard schedule will be retained until further notice.

However, if you would like us to apply our existing retention policies to your data, we will exempt them from this protocol. Please confirm that you do not want us to preserve your data by contacting [email protected].

We understand that this is a departure from our published practices and that our customers value the privacy protections we have committed to. We want to be transparent about why this change has been made. We are required by law to preserve records that may be relevant to legal proceedings. This obligation applies regardless of our internal data-retention policies and overrides our standard deletion schedule.

During this period, all retained customer data will be stored securely and access will be restricted to authorized personnel. Retained data will not be used for any purpose other than compliance with legal obligations. We will resume our standard data-blanking practices as soon as we are legally permitted to do so.

If you have questions about this change, please contact [email protected].

for more information and updated always check out https://t.co/wI8WAlOMWe

[COLDCARD @COLDCARDwallet]

Extremely important correction.

@jackmallers there wasn’t a weak entropy fallback. I think it’s important to be precise about what actually happened.

The weak PRNG (Yasmarang) wasn’t Coinkite’s fallback—it was MicroPython’s built-in general-purpose RNG, introduced upstream in May 2018. It didn’t become part of Coldcard’s seed generation until the libNgU migration in March 2021.

Most language runtimes include a non-cryptographic RNG like this for general purposes such as shuffling, timing jitter, or other non-security-related randomness. By itself, that’s not unusual.

Coinkite’s design intent was actually the opposite of having a software fallback: seed generation was supposed to rely exclusively on the hardware TRNG and never use the software RNG. Setting MICROPY_HW_ENABLE_RNG=0 was intended to disable that software path.

The issue is that this setting didn’t have the intended effect, and the symbol instead resolved to the runtime’s default implementation. So what people are describing as a “fallback” wasn’t an intentional design decision or a shortcut in the seed-generation logic—it was inherited behavior from the underlying platform that became active because of a link-time error.

[COLDCARD @COLDCARDwallet]

You can follow COLDCARD's next firmware updates on GitHub, we are focusing the next release and customer key migration.

Follow the warning below.

[COLDCARD @COLDCARDwallet]

Please treat this as urgent. Migrate your funds. Follow the advisory for your model, upgrade your device, generate a new seed, and carefully move your funds.

Help spread the word, especially to people who are less online and may not see this update.

The threat is still ongoing.

[COLDCARD @COLDCARDwallet]

This UI display bug that was fixed in version 1.3.4Q, released 2025-09-30

[COLDCARD @COLDCARDwallet]

https://t.co/C6FZElsvYv

[COLDCARD @COLDCARDwallet]

🚨 NOTICE: Claims that current firmware permanently bricks COLDCARD devices are incorrect.

If this TRNG fault occurs, power-cycle it: fully remove all power, then restart.

The state is volatile, nothing is written to flash, and it fails closed. Fix:
https://t.co/hV7nrBMn0U

[COLDCARD @COLDCARDwallet]

Please treat this as urgent. Migrate your funds. Follow the advisory for your model, upgrade your device, generate a new seed, and carefully move your funds.

Help spread the word, especially to people who are less online and may not see this update.

The threat is still ongoing.

[COLDCARD @COLDCARDwallet]

Why destroy affected inventory?

COLDCARD has a series of high-security system locks. Once programmed, it cannot be re-upgraded until the user initializes it.

We cannot ship units with affected firmware and risk users missing the upgrade.

The safest action was to destroy all the affected inventory and ship only those with the new fixed firmware.

[COLDCARD @COLDCARDwallet]

https://t.co/BmZF7BjKQr

[COLDCARD @COLDCARDwallet]

🚨 UPDATE: We halted COLDCARD shipments as soon as we confirmed the vulnerability. All remaining units at our facilities with affected firmware installed were destroyed.

Some orders had already shipped. We contacted those customers directly by email with the advisory and migration steps.

SATSCARD, OPENDIME and TAPSIGNER use different codebases and are not affected.

Right now, our full focus is helping affected users migrate safely.

[COLDCARD @COLDCARDwallet]

It’s been challenging, but we have now emailed every address we could reach through our store and newsletter systems.

The emails have been going out in batches since Friday. If you received one, we want to confirm that it is legitimately from Coinkite.

[COLDCARD @COLDCARDwallet]

Please treat this as urgent. Follow the advisory for your model, upgrade your device, generate a new seed, and carefully move your funds.

Help spread the word, especially to people who are less online and may not see this update.

[COLDCARD @COLDCARDwallet]

🚨 COLDCARD SECURITY UPDATE [Jul 31, 9:40 EDT]

Mk3 4.2.0 is now available.

Affected seeds without ≥50 fair, independent, private dice rolls:
👉 Mk3 4.0.1–4.1.9
👉 Mk4/Mk5 <5.6.0
👉 Q <1.5.0Q

Update first. Generate a new seed. Migrate carefully.

https://t.co/HshUxevCl3

[COLDCARD @COLDCARDwallet]

The first post was the advisory and what users should do.

This second post has the technical details: what actually went wrong, why our reviews missed it, the impact across Mk3/Mk4/Q/Mk5, and what we changed.

https://t.co/HshUxevCl3

( current evaluating Mk3 firmware release )

[COLDCARD @COLDCARDwallet]

COLDCARD Mk3 Security Advisory

If you generated a seed on a Mk3 after firmware 4.0.1, your funds may be at risk.

Mk4, Q and Mk5 are not affected based on our early analysis.

Read the advisory and migrate carefully:

https://t.co/3vgPHOjMS7

[COLDCARD @COLDCARDwallet]

Can't counterfeit Bitcoin.

[COLDCARD @COLDCARDwallet]

One COLDCARD. Many Wallets.

BIP85 lets you deterministically derive independent child seed phrases from your COLDCARD's master seed for different wallets and different use cases.

Learn more about how BIP85 can make managing multiple wallets easier. 👇

https://t.co/6JZoxQd2xG

[COLDCARD @COLDCARDwallet]

Don't loose your secrets.
Chance to win an arca 👇