What is Coldcard?

July 3, 2020

⚠️ Critical random number generator vulnerability. Updated 2 August 2026.

A flaw was found in COLDCARD firmware: since 2021 the device silently used MicroPython’s software fallback generator instead of the hardware TRNG. On 30 July 2026, 594.48 BTC were swept from roughly five hundred addresses in a single burst.

Every model except the Mk1 is affected — Mk2, Mk3, Mk4, Mk5 and Q. Fixed firmware: 4.2.0 for the Mk3, 5.6.0 for the Mk4 and Mk5, 1.5.0Q for the Q.

...