Coldcard Seed-Generation Flaw Affects More Models Than Initially Reported, Bitkey Lead Warns

Max Guise, who leads development of Block’s Bitcoin wallet Bitkey, has warned that a seed-generation vulnerability in Coinkite’s Coldcard hardware wallets affects more models than previously disclosed. In a post on X, Guise said the issue impacts not only the earlier identified Mk3 but also the Mk2, Mk4, Q, and Mk5.

Scope of the Vulnerability

Guise noted that the severity of the vulnerability varies by model. He cautioned that “the likelihood of an ongoing theft attack is high, and there is a risk of additional wallets being compromised.” Even if recovery phrases generated on these devices are transferred to another wallet, the risk remains. The attack surface extends beyond single-signature wallets to include multi-signature setups where two or more key generation processes are affected, as well as wallets using easily guessable passphrases.

Response and Impact

Guise confirmed that Block products, including Bitkey, are not affected by this vulnerability. He also stated that the findings have been shared with Coinkite, the manufacturer of Coldcard devices. The disclosure adds a new layer of concern for hardware wallet users, who often rely on these devices for cold storage security.

Why This Matters

Hardware wallets are considered one of the most secure ways to store cryptocurrency, but this incident highlights that even trusted devices can have hidden flaws. For users holding significant assets, the warning underscores the importance of staying informed about firmware updates and security advisories. It also raises questions about the thoroughness of security audits across different hardware wallet models.

Conclusion

As the situation develops, Coldcard users are advised to monitor official channels from Coinkite for guidance. The broader takeaway is that no wallet is immune to vulnerabilities, and regular security reviews are essential for anyone managing digital assets.

FAQs

Q1: Which Coldcard models are affected by the seed-generation vulnerability?
According to Max Guise, the vulnerability affects the Mk2, Mk3, Mk4, Q, and Mk5 models. The severity varies by model.

Q2: Is the Bitkey wallet affected by this vulnerability?
No, Guise confirmed that Block products, including Bitkey, are not affected.

Q3: What should Coldcard users do to protect themselves?
Users should monitor Coinkite’s official announcements for firmware updates and consider moving funds to a wallet with a different key generation process if they are concerned.