COLDCARD wallet RNG flaw likely linked to $88 million Bitcoin theft
Source Bleeping Computer
Fixed in 5.6.0 : update affected systems when convenient.
Data as of 4 Aug 2026, 17:47 UTC
Rated by Threat Radar
- Patch
- Available – fixed in 5.6.0
What to do
AI-suggested
Fixed firmware versions are available and should be installed: 4.2.0 or later for Mk2/Mk3, 5.6.0 or later for Mk4/Mk5, 1.5.0Q or later for Q devices, and 6.6.0X/6.6.0QX for Edge releases. Users must verify existing backups, update firmware, generate new seeds, verify new wallet addresses, test with small transactions, and then migrate remaining funds. Old backups should be retained until migration is confirmed complete. Seeds supplemented with at least 50 fair, independent, and private dice rolls are not considered at risk from this flaw alone. Strong unique BIP-39 passphrases increase security but do not repair compromised seeds. Coinkite's TAPSIGNER, OPENDIME, and SATSCARD products are unaffected. Users should follow official migration instructions and treat existing seeds as compromised.
Description
A vulnerability in COLDCARD hardware wallet firmware allowed attackers to steal an estimated $88.6 million in Bitcoin from thousands of wallets whose seeds were generated using a flawed random number generator. [...]