Coldcard Raises Fresh High-Priority Alert on Ongoing Bitcoin Wallet Vulnerability

Hardware wallet maker Coldcard issued a new high-priority security notice, warning that the cryptographic threat tied to a vulnerability impacting its users has not been fully resolved. Coldcard urged customers to transfer their Bitcoin to newly created wallets and generate entirely new recovery words (seed phrases). The company said the risk remains for the flaw affecting the key-generation process, which has been linked to roughly $40 million in losses. Users were also told to update device firmware and stop using addresses produced through older derivation methods, citing the possibility of unauthorized transfers. Coldcard rejected allegations that its latest firmware permanently bricks devices. The firm said that if a temporary random number generator (TRNG) error occurs, normal hardware should recover by fully disconnecting the unit from all power sources and restarting. In its statement, Coldcard said: “Claims that the latest software permanently renders Coldcard devices unusable are incorrect. In the event of a TRNG error, completely disconnect the device and restart it. The situation is temporary; no data will be written to the flash memory, and the system is designed to shut down safely.” Developers added they have seen no evidence the current TRNG fix causes permanent device failure. They said a complete shutdown and restart should restore operation in cases of a temporary TRNG seed error. A new patch is now in development to harden the post-error recovery process for the random number generation system. Coldcard said the update will follow STMicroelectronics’ documented recovery procedure and add safeguards including a capped number of retries, seed error detection, and deletion of older RNG outputs after recovery. Coldcard said support for Coldcard Mk3 devices will be handled in a separate software update. This is not investment advice.