IMPORTANT SECURITY UPDATE REGARDING COLDCARD
Please read if you are a coldcard user.
IMPORTANT SECURITY UPDATE:
COLDCARD users who relied solely on device-generated randomness may be at risk from a security vulnerability that may steal your coins. Users who followed best practices and generated their seed with 100 fair, independent, and private dice rolls are not considered at risk. 50+ rolls seems to also be safe.
If you generated your seed on a coldcard without 100 dice rolls, you should:
Generate a completely new seed on an unaffected device or airgapped computer.
Carefully record and verify the new backup.
Verify the wallet fingerprint and receiving address on the hardware wallet.
Send a small test transaction.
Confirm that everything works before moving the remaining funds.
Alternatively, and if any of this is confusing or feels uncertain, move your funds to an exchange custodian temporarily while you figure out how to set up a new seed safely.
Anyone uncertain about the firmware used, the number of dice rolls, or whether those rolls remained private should assume the seed may be affected and migrate.
The bug prevented the hardware random-number generator from contributing the intended amount of entropy during seed generation, substantially reducing the effective seed-search space. It is not a bug in bitcoin and it doesn’t affect any wallets not using coldcard firmware.
A strong, unique BIP-39 passphrase adds an independent security barrier, but the protection depends entirely on the strength and secrecy of that passphrase. Even users with a strong passphrase should migrate to a newly generated seed as soon as practical.
Never enter your seed words or passphrase into a website, computer, phone, chatbot, or “recovery service.” Do not panic, but do not ignore this. Proceed calmly, verify every step, and act promptly. For further updates, rely on official Coinkite and COLDCARD sources:
• Security announcements: https://blog.coinkite.com
• COLDCARD on X: @COLDCARDwallet
• Coinkite on X: @Coinkite
• Firmware releases and upgrade instructions: https://coldcard.com/docs/upgrade/
Be cautious of unsolicited messages, unofficial “recovery tools,” and accounts offering to help migrate your funds.
Best,
Saif
Terrible for everyone that lost their savings. Really sad for privacy. 2021 was still before major exchanges had kyc. 10k BTC moved to exchanges due to this incident lots of anonymity lost.