Coinkite, the company behind Coldcard, has shipped a firmware update that will not generate a new wallet seed until the owner supplies randomness by hand.

That means at least 50 dice rolls, 128 coin flips, or 65 timed key presses, three weeks after a defect in its random number generator opened customer funds to attackers.

Coldcard’s two device lines run separate firmware tracks, so the release carries two numbers, 5.6.1 for the Mk4 and Mk5, and 1.5.1Q for the Q, the larger model with a keyboard and QR scanning.

Boot Check Targets the Defect

Coinkite stated that the input is added on top of device randomness from the STM32 TRNG and both secure elements.

Coldcard was built to draw seed entropy only from its hardware generator, but Coinkite traced the failure to a build and link error that left the setting meant to disable the software path without effect, sending the random-number call to MicroPython’s Yasmarang PRNG, which entered the seed path in March 2021.

Affected seeds carry about 72 bits of entropy instead of the expected 128 bits after 594.5 BTC was swept from 500 addresses on July 30.

Firmware 5.6.1 now verifies at boot that the random-number call reaches the intended hardware path, halting the device if it fails. Coinkite replaced Yasmarang with a SHA-256 Hash_DRBG, specified in NIST SP 800-90A, and seeds it at startup with a full 256-bit digest from both secure elements, which earlier firmware truncated to 32 bits.

Key mashing follows Peter Todd’s push-button RNG design, hashing keypad press timing at CPU-cycle resolution. The first press sets a reference, and each of the 64 gaps that follow is credited with two bits of entropy.

Old Seeds Still Need Migrating

“Installing this update does not make an existing vulnerable seed safe,” Coinkite wrote, directing anyone whose seed may have been generated on affected firmware between 2021 and July 2026 to create a replacement and move their Bitcoin (BTC). Mk2 and Mk3 fall outside this release, and their minimum fixed version stays at 4.2.0.

A compromised USB host could rewrite a staged transaction after the owner approved it, so the signature covered different outputs. The device now rechecks those bytes before signing and stops with a “Transaction modified” warning.

Coinkite’s new Security Status page lists four independent reviews, among them a real-device test that observed eight hardware RNG reads for a 32-byte seed request and a rebuild matching every byte of the signed firmware.

The company noted that the checks are “not a complete audit of every firmware binary.” As CryptoPotato reported, confirmed losses passed $100 million, with Galaxy Research counting 1,596 BTC from roughly 7,300 addresses, and a suspected fourth wave sweeping nearly 449 BTC on August 3.

Source: CryptoPotato