SECURITY
Coinkite Confirms Coldcard Security Issue — Is Your Wallet Affected?
Wallet maker Coinkite has confirmed a security issue affecting some Coldcard devices. Here's what's known so far, who's likely unaffected, and what to check on your own device right now.
WHY IT MATTERS
Coldcard is one of the most trusted names in self-custody hardware — a confirmed security issue at Coinkite gets attention precisely because the brand's whole pitch is being the paranoid option. How this is handled, and how quickly, matters to anyone relying on hardware-wallet security assumptions broadly, not just Coldcard owners.
What Coinkite has confirmed
Coinkite confirmed the issue and said its early investigation indicates that newer Mk4, Q, and Mk5 devices are not affected. The company has not yet detailed the exact scope, root cause, or which earlier models or firmware versions may be exposed — details we'll update here as Coinkite publishes its full advisory.
A passphrase significantly lowers your risk
Users who protected their wallets with a BIP 39 passphrase appear to face significantly lower risk, according to Coinkite. A passphrase functions as a "25th word" — a second factor that isn't stored anywhere near your seed backup, so even a full compromise of the seed phrase alone doesn't expose funds without it.
What to check right now
If you own a Coldcard: confirm your model and firmware version against Coinkite's official channels, and if you haven't already, consider adding a BIP 39 passphrase to your existing setup. Don't move funds or take action based on secondhand reports — wait for Coinkite's official advisory with specific affected serial ranges or firmware versions before assuming anything about your own device.
What to watch next
Coinkite's full technical advisory, including exact scope and any recommended firmware update or migration steps for affected users.
Common questions
Is my Coldcard Mk4 affected?
Coinkite's early investigation indicates newer Mk4, Q, and Mk5 devices are not affected. Confirm your firmware is current and watch for the official advisory.
Does a passphrase protect against this?
Yes — Coinkite says wallets using a BIP 39 passphrase face significantly lower risk.
TERMS IN THIS STORY
Sam Okafor
Wallets & security reporter, Bitcoin Almanack