A Rare Security Advisory from One of Bitcoin’s Most Trusted Wallet Makers
On July 30, 2026, Coinkite—the company behind the popular COLDCARD hardware wallet—issued an official security advisory regarding the COLDCARD Mk3.
The announcement quickly spread throughout the Bitcoin community because COLDCARD has long been regarded as one of the most secure Bitcoin-only hardware wallets available.
The advisory states:
If you generated a seed on a COLDCARD Mk3 running firmware newer than version 4.0.1, your wallet may be vulnerable.
Fortunately, Coinkite also stated that their initial investigation indicates the Mk4, Mk5, and COLDCARD Q are not affected.
This is not a hack of Bitcoin.
It is not a flaw in SHA-256.
It is not a weakness in BIP-39 seed phrases.
Instead, it appears to involve the way randomness—or entropy—was generated inside certain COLDCARD Mk3 devices.
Understanding What Actually Happened
Every Bitcoin wallet begins with one simple requirement:
Generate a number that nobody else on Earth could ever guess.
That number eventually becomes your:
- 12-word seed phrase
- 24-word seed phrase
- Master private key
- Entire wallet
If that random number is truly random, your wallet is effectively impossible to guess.
If that randomness is flawed…
Everything built from it becomes predictable.
That appears to be the heart of this vulnerability.
Why Randomness Matters
When a wallet creates a new seed phrase, it doesn’t simply choose words.
Instead, it generates a very large random binary number.
Examples include:
- 128 bits (12 words)
- 256 bits (24 words)
The BIP-39 words are simply a human-readable representation of that random data.
Think of the seed phrase like this:
The words are merely the label.
The real secret is the underlying random number.
The Role of the Random Number Generator (RNG)
The proof-of-concept released alongside the advisory appears to demonstrate that researchers could reconstruct the wallet’s master private key using:
- Timing information
- Device characteristics
- Knowledge of the RNG behavior
- Public wallet information (such as the xpub)
The posted output includes:
- Recovery of the master private key
- Recovery of the seed phrase
- Matching xpub
- Successful signature verification
If independently verified, this would represent cryptographic proof that certain seeds generated on affected Mk3 devices were not as random as intended.
Is Bitcoin Broken?
Absolutely not.
Bitcoin’s cryptography remains intact.
Nothing about:
- SHA-256
- ECDSA
- Schnorr signatures
- secp256k1
- BIP-32
- BIP-39
has been broken.
Instead, this resembles giving someone a weak password.
The lock still works perfectly.
The password wasn’t random enough.
Who Is Affected?
According to Coinkite’s current advisory:
Potentially affected:
- COLDCARD Mk3
- Seeds generated after firmware 4.0.1
Currently believed safe:
- COLDCARD Mk4
- COLDCARD Mk5
- COLDCARD Q
This may change as additional analysis becomes available.
What Should Users Do?
If you own a Mk3:
Do not panic.
Instead:
- Read Coinkite’s official advisory.
- Determine whether your wallet falls within the affected range.
- Follow Coinkite’s migration instructions carefully.
- Create a new wallet using an unaffected device.
- Transfer your bitcoin to addresses derived from the new seed.
- Verify every receiving address before sending funds.
Never expose your old seed phrase online while migrating.
Why Air-Gapped Doesn’t Mean Invulnerable
Many people mistakenly assume an air-gapped wallet cannot fail.
Air-gapping protects your wallet from network attacks.
It does not protect against:
- Poor entropy
- Firmware bugs
- Manufacturing defects
- Supply-chain attacks
- User mistakes
Security depends on every component functioning correctly.
Lessons for Every Bitcoin Holder
This event reinforces several important principles:
- Trust, but verify.
- Open-source security matters.
- Hardware wallets should be independently audited.
- Entropy is one of the most critical parts of wallet security.
- Even respected companies can discover vulnerabilities years after release.
The Bitcoin ecosystem benefits when researchers responsibly disclose flaws and manufacturers respond transparently.
Final Thoughts
One of the strengths of Bitcoin’s security culture is that vulnerabilities are disclosed openly rather than hidden. Coinkite’s decision to publish a detailed advisory allows users to take action before attackers can exploit the issue at scale.
The takeaway isn’t that hardware wallets are unsafe. It’s that security is a process, not a product. Every component—from the randomness used to generate a seed phrase to the firmware running on a device—must work correctly to keep your bitcoin secure.
As more technical details emerge, the Bitcoin community will gain a clearer understanding of exactly how this vulnerability occurred and what it teaches us about designing even more secure self-custody solutions.
