Coinkite has released a critical security update for its Coldcard devices, urging users to immediately generate new seed phrases. This measure aims to mitigate a previous vulnerability that compromised the randomness of private keys and resulted in the loss of thousands of Bitcoins.
The origin of the vulnerability in Coldcard wallets
Security in the crypto ecosystem is a fundamental pillar for any user who decides to manage their own assets. Recently, a critical flaw was detected in seed generation, resulting in confirmed losses of 1.778 BTC. This incident has highlighted the importance of entropy in cryptographic key creation.
The problem dates back to a firmware bug introduced in March 2021, which weakened the randomness of the seeds generated on certain Coldcard devices, drastically reducing cryptographic strength to levels susceptible to brute-force attacks.
How the new firmware update works
To address this vulnerability, Coinkite has released new firmware versions for the Coldcard Mk4, Mk5, and Coldcard Q models. The update redesigns the seed phrase generation process, introducing a hybrid approach that combines hardware randomness with entropy contributed directly by the user through dice rolls, coin tosses, or manual presses.
The urgency to generate a new seed phrase
Simply updating the firmware does not protect funds stored in wallets created with older, vulnerable versions. Users must update the firmware, generate a new seed phrase, and transfer all funds from the old wallet to the new one to ensure their protection.
FAQ
Is updating the firmware enough?
No. The update corrects the generation of new keys, but existing vulnerable seed phrases must be replaced by migrating funds to a new wallet.
Which models are affected?
The Coldcard Mk4, Mk5 and Coldcard Q devices that used affected firmware versions to generate their seeds.
Keeping self-custody tools up to date and following security best practices is essential to protecting your crypto assets against emerging vulnerabilities.
Investing in cryptoassets is not fully regulated, may not be suitable for retail investors due to high volatility and there is a risk of losing all invested amounts.
Generative artificial intelligence tools were used to create this article.
