The Death of Bitcoin Self-Custody — What Happens After COLDCARD? | Zach Herbert, Michael Tanguma, Josh Groth

EMERGENCY: Your COLDCARD Seed May Be Broken. Here Is What To Do Coinkite has disclosed a firmware bug that caused COLDCARD hardware wallets to generate seed phrases without proper randomness. Roughly 594 BTC, about 38 million dollars, was swept from nearly 500 wallets in a handful of blocks. If you generated a seed on a COLDCARD, act before you finish watching. The most important thing to understand: the firmware hotfix protects new seeds only. It does not repair a seed that was already created on vulnerable firmware. Updating your device does not make you safe. Migrating to a new seed does. WHO IS AFFECTED COLDCARD Mk3 running firmware 4.0.1 through 5.0.3: Coinkite estimates the effective search space at roughly 40 bits instead of the intended 128. Treat these seeds as at risk and migrate now. COLDCARD Mk4, Mk5, and Q: additional entropy from the secure elements put these at roughly 72 bits, better than Mk3 but still below the 128-bit target. Coinkite advises updating to firmware 5.6.0 (Mk4 and Mk5) or 1.5.0Q (Q), then generating a completely new seed. Seeds protected by a strong, unique BIP-39 passphrase, or created with at least 99 independent dice rolls, are at minimal risk according to Coinkite's early analysis. TAPSIGNER, OPENDIME, and SATSCARD are not affected. They use a different codebase. IMPORTANT Coinkite has not confirmed that the on-chain sweep was caused by this bug. Researchers consider it the most plausible explanation, and the investigation is ongoing. No COLDCARD device was physically breached, no PIN was defeated, and no secure element was broken. This is a seed generation flaw. Never enter your seed phrase into any website or tool claiming to check whether you are vulnerable. Expect scam checkers to appear. Migrate calmly, verify your wallet fingerprint, and send a small test transaction before moving the rest. OFFICIAL SOURCES Coinkite Mk3 advisory: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/ Coinkite technical backgrounder: https://blog.coinkite.com/entropy-technical-backgrounder/ Firmware downloads: https://coldcard.com/docs/upgrade GUESTS Josh of Nova Sapiens Michael of OnRamp Zach of Foundation Devices