Coinkite, the Canadian company behind the COLDCARD hardware wallet, has released firmware updates 5.6.1 for Mk4 and Mk5 devices and version 1.5.1Q for Q-series models. The update follows the exploitation of a seed-generation flaw present in the code since firmware 4.0.1 released in March 2021, which allowed attackers to steal approximately 1,816 BTC, worth roughly $114M to $116M. The vulnerability affected the true random number generator (TRNG) built into the devices via the libngu library, significantly reducing entropy to approximately 40 bits on Mk2 and Mk3 models. Attacks began on July 30, 2026, and Coinkite issued an urgent hotfix the next day. The new firmware now makes it mandatory for users to contribute physical randomness via dice rolls or timed keypresses during seed generation.
Source: Read the original article
