EMERGENCY: Live COLDCARD Exposed Bug Support w/ Bitcoin Mentor

A critical vulnerability in Coldcard hardware wallets has left Bitcoin holders scrambling to move funds, with roughly 1,000 BTC already seen moving on-chain. The bug traces back to a firmware change around 2021 that caused the device to fall back to a software pseudo-random number generator instead of true hardware randomness — meaning private keys generated since then have far fewer possible combinations than anyone realized. MK3 devices are the most exposed, but MK4, MK5, and the Q are also affected. In this episode: • BTC Sessions and Nathan from BTC Mentor run a live help desk, walking viewers through exactly which Coldcard models are vulnerable and why — MK3 seeds had roughly 40 bits of entropy, MK4/MK5/Q around 72 bits, all dangerously low • Patch firmware version 5.6.0 for MK4/MK5 and 1.5.0 for the Q was released, but updating firmware alone does nothing — any seed generated before the fix must be migrated to a newly generated one • Dice rolls (100 minimum) and a strong passphrase may have bought time but are not guaranteed safe — the hosts recommend treating all Coldcard-generated seeds as compromised and migrating regardless • Recommended destinations for funds: Blockstream Jade, Trezor Safe 3/5/7 with Bitcoin-only firmware, Foundation Passport Core, Seedsigner, or even a passphrase-protected Sparrow hot wallet as a temporary measure • Multi-sig setups are only at risk if the number of Coldcard keys meets or exceeds the signing threshold — a single compromised key in a two-of-three with non-Coldcard devices is manageable but should still be replaced • Bitkey investigators identified an attacker using a paid blockchain analytics account, and authorities have been notified — hosts urge affected users to preserve their key records in case funds are ever recovered • BTC Sessions announces he is terminating his Coldcard sponsorship, citing lost trust and frustration with Coinkite's broader conduct toward other wallet developers over the years The full debrief and unfiltered takes drop on the video version of Bitcast — find it on the BTC Sessions YouTube channel. Watch the video version: https://youtu.be/_ld5oX1LKas