Coinkite has released a new firmware update for Coldcard hardware wallets that requires users to provide their own randomness by hand before generating a new wallet seed. The update follows a defect in the device's random number generator that exposed customer funds to attackers.
The new requirement means users must supply at least 50 dice rolls, 128 coin flips, or 65 timed key presses. The key mashing follows a design that hashes keypad press timing at CPU-cycle resolution, where the first press establishes a reference and subsequent gaps are credited with entropy.
The updates carry version numbers 5.6.1 for the Mk4 and Mk5 models, and version 1.5.1Q for the Q model. Coinkite stated that this user-provided input is added on top of device randomness derived from the STM32 TRNG and secure elements.
The security issue was traced to a build and link error originating in March 2021, which caused random-number calls to route to MicroPython’s Yasmarang PRNG instead of the intended hardware path. Affected seeds carried about 72 bits of entropy instead of the expected 128 bits. Reports indicate that confirmed losses surpassed $100 million, with Galaxy Research noting significant losses across thousands of addresses.
Firmware 5.6.1 verifies at boot that random-number calls reach the hardware path and halts the device if the check fails. Coinkite also replaced Yasmarang with a SHA-256 Hash_DRBG and updated the startup seeding process.
Coinkite emphasized that installing the update does not secure existing vulnerable seeds. Users with seeds generated on affected firmware between 2021 and July 2026 are advised to create a replacement seed and move their funds. Additionally, the update addresses a transaction-signing vulnerability by having the device recheck bytes before signing to prevent modifications by a compromised USB host.
