Coldcard
Coldcard is a product of Coinkite. Corporate history of Coinkite is covered on that title.
| Developers | Coinkite |
| License | Verifiable / open firmware materials published by vendor |
| Website | https://coldcard.com/ |
Coldcard is a Bitcoin-only hardware wallet from Coinkite, designed for air-gapped or tightly controlled transaction signing. In 2026, a seed generation vulnerability affecting certain Coldcard firmware versions was disclosed, resulting in the theft of bitcoin. See Security incidents for details.
Design
As of September 2026, coldcard.com presents Coldcard as a Bitcoin-only device that can be set up on-device without a required Coldcard account or mandatory companion app, with compatible wallet software chosen by the user, PSBT workflows, and standard recovery material. Air-gapped signing and verifiable source code are emphasised on that homepage.[1]
Coldcard documentation describes BIP39 seed backup (including passphrase support), native Partially Signed Bitcoin Transaction (PSBT, BIP 174) workflows, MicroSD “sneakernet” air-gap use, USB operation, MicroPython-based firmware, and encrypted MicroSD backup.[2]
Models and features
The Coldcard site lists current and recent device lines (including Mk5 and Q product pages linked from the homepage) and documents optional interfaces such as MicroSD, NFC, USB-C, and QR-oriented workflows depending on model. Homepage marketing also lists duress PIN features among advanced security tools.[1]
Security incidents
Seed generation vulnerability (2026)
In July 2026, a vulnerability was identified in Coldcard firmware that compromised the randomness used to generate certain recovery seeds. The issue originated from a software change introduced in March 2021, which caused an unsuitable pseudorandom number generator to be used instead of the hardware random number generator.[3]
The vulnerability affected seeds generated by certain firmware versions on the Mk2, Mk3, Mk4, Mk5, and Q models. Attackers were able to reconstruct vulnerable private keys without physical access to the devices, resulting in the theft of bitcoin. In August 2026, researchers estimated that losses could reach $114 million.[4]
Coinkite released firmware updates to correct the seed generation process. However, these updates do not secure seeds previously generated with insufficient entropy. Affected users were advised to generate a new seed using updated firmware and transfer their funds to a new wallet.[5]
See also
External links
References
- ↑ 1.0 1.1 Coldcard homepage
- ↑ Coldcard docs
- ↑ "Adding to the Public Record on Our Ongoing Investigation". Coinkite. 4 August 2026. https://blog.coinkite.com/adding-to-public-record/.
- ↑ "Coldcard urges users to move bitcoin as exploit is still in progress". CoinDesk. 4 August 2026. https://www.coindesk.com/tech/2026/08/04/coldcard-urges-users-to-move-bitcoin-as-active-wallet-exploit-continues.
- ↑ "Current COLDCARD Security Status". Coinkite. https://coldcard.com/security/status.