Important note:
If you generated your seed on an affected Coldcard and later moved it to a Trezor, you are still affected. The seed was created with weak randomness on the Coldcard, restoring it elsewhere does not fix that. Please generate a fresh seed on your Trezor and carefully move your funds.
IMPORTANT SECURITY UPDATE:
COLDCARD users who relied solely on device-generated randomness may be at risk from a security vulnerability that may steal your coins.
Users who followed best practices and generated their seed with 100 fair, independent, and private dice rolls are not considered at risk. 50+ rolls seems to also be safe.
If you generated your seed on a coldcard without 100 dice rolls, you should:
1. Generate a completely new seed on an unaffected device or airgapped computer.
2. Carefully record and verify the new backup.
3. Verify the wallet fingerprint and receiving address on the hardware wallet.
4. Send a small test transaction.
5. Confirm that everything works before moving the remaining funds.
Alternatively, and if any of this is confusing or feels uncertain, move your funds to an exchange custodian temporarily while you figure out how to set up a new seed safely.
Anyone uncertain about the firmware used, the number of dice rolls, or whether those rolls remained private should assume the seed may be affected and migrate.
The bug prevented the hardware random-number generator from contributing the intended amount of entropy during seed generation, substantially reducing the effective seed-search space. It is not a bug in bitcoin and it doesn't affect any wallets not using coldcard firmware.
A strong, unique BIP-39 passphrase adds an independent security barrier, but the protection depends entirely on the strength and secrecy of that passphrase. Even users with a strong passphrase should migrate to a newly generated seed as soon as practical.
Never enter your seed words or passphrase into a website, computer, phone, chatbot, or “recovery service.” Do not panic, but do not ignore this. Proceed calmly, verify every step, and act promptly. For further updates, rely on official Coinkite and COLDCARD sources:
• Security announcements: https://t.co/JU2kqtsqJh
• COLDCARD on X: @COLDCARDwallet
• Coinkite on X: @Coinkite
• Firmware releases and upgrade instructions: https://t.co/FNbbpN0Gnk
Be cautious of unsolicited messages, unofficial “recovery tools,” and accounts offering to help migrate your funds.
BREAKING: Using quantum lip-reading, DARPA audio tech, and an NSA microwave mic from a dumpster, we recovered Netanyahu, Hegseth, and Rubio’s full private conversation at Lindsey Graham’s funeral.
Hidden camera in London catches a senior rabbi ordering abuse victims to stay silent and never call the police.
Rabbis raped little girls inside his Stamford Hill synagogue.
Parents knew. They stayed quiet, terrified of being shunned by the community.
@derHelper Ah okay krass das mit den banking apps. Das ist immer so ärgerlich, dass du auf Komfort verzichten musst, wenn du dich für privacy entscheiden musst. 😂
A friend in Lebanon has built open-source software that turns any Android phone into an air-gapped Bitcoin hardware wallet and signing device.
Check it out:
https://t.co/veprwiDu40
BEN SHAPIRO: “There’s no evidence Epstein trafficked children to his island.”
JEFFREY EPSTEIN: “Hold my toddler.”
And yes, that email is f*cking real. See for yourself: https://t.co/oN8SPP2Mp8