Coinkite issues mandatory firmware update to fix Coldcard seed-generation flaw after $100 million Bitcoin theft

Coinkite has released a critical firmware update for its Coldcard hardware wallets after a security flaw in the seed-generation process led to the theft of more than $100 million in Bitcoin. The company announced the mandatory upgrade on Thursday, August 20, 2026, urging users of Coldcard Mk4, Mk5, and Q models to install the new software and generate entirely new wallet seeds.

The vulnerability, which originated in a firmware bug dating to March 2021, reduced the cryptographic randomness, or entropy, used to create wallet seeds. This weakness made private keys far easier for attackers to guess remotely. Exploitation began in July 2026, with the first wave draining approximately 594 Bitcoin, worth about $38 million at the time, from roughly 500 wallets in just 25 minutes. By August 14, security researchers at Galaxy reported total losses had reached 1,778 Bitcoin, valued at roughly $112 million, across multiple attack waves. The incident is among the largest cryptocurrency exploits of the year.

The newly released firmware, versions 5.6.1 and 1.5.1Q, fundamentally changes how seeds are generated. It now requires users to actively contribute randomness by performing at least 65...