Critical Coldcard Security Bug: Move Your Bitcoin Now

Users of Coldcard MK3, MK4, MK5, and Q models must act fast to secure their Bitcoin. A security bug allows attackers to discover seed phrases that were not generated using at least 50 manual dice rolls. This vulnerability has been active since the end of 2020, and reports confirm that roughly 1000 BTC have already been drained from compromised wallets.

If you did not use the dice roll method to generate your seed, your funds are at high risk. You should transfer your Bitcoin to a different hardware wallet as soon as possible. If you do not have another hardware device, you can temporarily add a six word passphrase to your existing wallet to block attackers, then move your funds to a secure software wallet like Nunchuck, Blockstream Green, or Bluewallet.

Once your funds are safe, you can update your Coldcard to the latest firmware. This patch fixes the random number generation issue for future keys. Take your time to verify your backups and check in with any friends or family who use Coldcard devices, as many owners may not be aware of this urgent threat.