XKEYCHAINX LABS
Home / Disclosures / Coldcard / Case file
Coldcard / Public disclosure

Coldcard: weak seed generation and migration

Coinkite’s incident status describes weakened seed generation and thefts. Corrected firmware changes future generation; it does not strengthen an existing affected seed.

Source date: JUL 2026Reviewed: 11 October 2026

Affected scope

Multiple models · Seed generation

What the attack requires

A wallet seed generated under the vendor’s affected firmware conditions.

Response & remediation

What changed

Fixed firmware + seed migration

What this finding establishes

Minimum corrected versions listed by Coinkite: Mk2/Mk3 4.2.0; Mk4/Mk5 standard 5.6.0; Q standard 1.5.0Q; Mk4/Mk5 Edge 6.6.0X; Q Edge 6.6.0QX. The advisory explains affected scope, an independent-dice exception and seed migration. Consult it before treating a wallet as remediated.

Related case files