Coinkite’s New Coldcard Firmware Forces Physical Randomness Into Every Bitcoin Seed Generation

Coldcard Bitcoin hardware wallet maker Coinkite has released a new standard firmware update that changes how wallet seeds are created — by making physical randomness mandatory at the moment a user generates a seed.

The update, rolled out on Aug. 20, means any new wallet seed now blends the device’s fresh entropy with at least one physical input source chosen by the user. Those options include 65 key presses made at unpredictable intervals, 50 rolls of a physical six-sided die, or 128 physical coin flips. The goal is straightforward: reduce the wallet’s reliance on its own random number generator, and give users a way to inject outside entropy into the fundamental building block of their bitcoin keys. It’s a meaningful shift in design philosophy for a hardware wallet that has long been popular among bitcoiners who treat self-custody and key security as a personal responsibility rather than a one-time setup task.

The forced entropy requirement is tied directly to a broader firmware package that also touches signing behavior, USB workflows, backup procedures, and the device’s boot-time checks. Coinkite says seeds generated with older firmware and still in active use may still be exposed, unless they meet a specific and quite narrow exception. For users who generated a seed using affected firmware, simply installing the newest version is not enough. The company’s migration guidance tells those users to generate a completely new seed, verify its backup and wallet fingerprint, confirm a receiving address on the device, send a small test transaction, and only then move the full balance out of any wallet tied to the old seed. Restoring or cloning an existing wallet does not create a new seed, and does not remove old wallet data from circulation.

The scope of the advisory is wider than many owners may expect. Coinkite currently recommends version 5.6.1 for Mk4 and Mk5 devices and version 1.5.1Q for Q devices, but the exposure list covers multiple tracks. On the official list, Mk2 and Mk3 devices running firmware 4.0.1 through 4.1.9 are affected; Mk4 and Mk5 devices running standard firmware before 5.6.0, or Edge firmware before 6.6.0X, are affected; and Q devices running standard firmware before 1.5.0Q, or Edge firmware before 6.6.0QX, are affected. A separate technical analysis by Block, the independent firm reviewing the vulnerability, draws a broader boundary for Mk2 and Mk3 devices and includes version 4.0.0. That means owners of those older Coldcard models should not treat the vendor’s initial boundary as proof of safety. If there is any doubt about the firmware that created the seed, the safest course according to both Coink X and Block is to migrate to a freshly generated seed on fixed firmware.

The Discounted Change Was a Silent RNG Failure

The underlying flaw is a particularly nasty case of deterministic behavior in a security device. Coldcard’s source code, and the outside auditor’s report, told the story: certain requests could be fed into a destructive path because a feature flag defined as zero was treated as present. The result, in some cases, no true randomness from the hardware random number generator but a deterministic MicroPython fallback could be used instead. For a Bitcoin hardware wallet, that can be catastrophic, because if the key generation becomes predictable, an attacker in heavy circumstances could reconstruct Palo Private Keys or seed phrases from what should be random output.

The new mandatory human input is solve as a barrier against that class of failure: even if the device’s random-number generator fails again, the seed phrase can no longer be the product of device entropy alone. But it cannot add entropy to a seed that already exists. That is why Coinkite is so careful about the migrant exception. A user who added at least 50 fair, independent, and private physical die rolls into the affected workflow, and over never recorded or exposed their sequence, can plausibly be safe because physical die rolls provide enough external entropy to make a predictable device output unpredictable enough. Coinkite is not treating that as a lightly given exception. The exact requirements are strict. Fewer than 50 rolls, any public film footage, or the same value interpreted with a chance of exposure means the user should be on the safe side and migrate.

What Else Does the New Firmware Do?

The new firmware is not just a seed-generation patch. It touches multiple paths critical to bitcoin transactions. One improvement is on the USB and PSBT signing process. The firmware now stores a staged transaction checksum and binds the USB review screen to that same checksum, so what you see before signing is less likely to differ from what the signing hardware actually approves. It also rechecks transaction bytes immediately before signing, blocking a type of after-the-fact substitution if something slips through a software layer. A SIGHASH_SINGLE transaction is rejected by default now. That text is often considered unusable in ordinary bitcoin use and has a history of extended cases; blocking it by default gives the user a safer device without making regular use harder.

USB downloads are also restricted to the current encrypted-session result, which closes a previous roaming transaction-divergence scenario. Firmware file lengths must be validated. And the new build adds persistent RNG-fault stops and a boot-time hardware RNG linkage check, so if the random number generator is no longer providing secure entropy, the wallet will stop itself in uncertainty, instead of continuing with the certain output. Delta mode gets more isolation, and the wallet now prompts active wallet. The overall impression is a conventional security update aiming to marginalize the whole lifecycle of the wallet, from seed creation through transaction signing.

Dice Rolls Only Remains a Separate, More Extreme Other Path

The standard mixed regeiliation now requires one physical input to co-augment the device entropy. On some Coldcard, an advanced option called Dice Rolls Only is also available. That mode is distinct. It excludes hardware randomness entirely and depends on human-based physical entropy. Users who choose Dice Rolls Only must roll a physical six-sided die 50 times for a 12-word seed or 99 times for a 24-word seed. That path is intentionally more demanding and is meant for users who do not want to trust any part of the wallet’s random generator. The new standard process, by contrast, uses hardware entropy and one human source at minimum, so it is a compromise between insecurity and usability.

The severe, more careful workflow matters because many users generate their Coldcard seed recorder in a settings menu with maximum isolation. The new requirement reflects evidence that a device’s built-in randomness can be the weakest link in a Bitcoin wallet. Since the human-induced entropy sources can be hard to use, some users will continue to fall back to “Dice Rolls Only” if they want zero general randomness. At the same time, the mixed approach is more practical: 65 key presses, 50 die rolls, or 128 coin flips are all usable for an ordinary user.

No Full Audit, But Real Growth Verifications Good

The security status page lists evaluations that technicians have done: a targeted source review of the code base, a real-device RNG-path test, a reproducible build, and a dice-path trace. Coldcard does not claim the update is full a completely audited binary. The report says these checks do not amount to a complete audit of every fixed binary. That kind of honesty is rare but appropriate, especially when losing a hardware wallet seed can mean losing all bitcoin kept behind for good. The update also gives some clarity on impact. Coinkite says there were test casualties, real users affected and severe losses suffered. It says law enforcement is investigating, but it has not published a verified victim count or total amount of money loss.

Until more facts are documented, users should treat the update as an active security advisory rather than a simple feature bump. The most important takeaway is simple: if you create a new seed, fixed firmware will force you to include external human randomness. If you have fell in a seed on affected firmware, don’t wait for the next version or hope for the dice exception unless you are absolutely certain of private, at least 50 fair, independent rolls. Generate a new seed, verify the backup, make a very small test transaction, and then send the rest. In the Bitcoin wallet world, private keys are the final authority, and firmware shielding is what stands between them and a failed random number. Coinkite’s response is a strong reminder that even the most carefully constructed hardware wallets are only as good as the randomness they use to escape the keys.