What to Know

  • Coinkite has released new firmware for Coldcard hardware wallets after a randomness flaw enabled attackers to steal more than $114 million in bitcoin.
  • The company says AI tools, including Kimi and other frontier models, helped review the full Coldcard system and identify issues beyond the original flaw.
  • The update includes fixes tied to transaction approval, USB data handling and firmware validation.
  • Installing the firmware does not make a previously compromised wallet safe if the seed was created on affected firmware between 2021 and July 2026.
  • Users with affected seeds still need to generate a new seed and migrate their funds to a fresh wallet.
  • New Coldcard seeds now require physical randomness supplied by the user through 65 unpredictable key presses, 50 rolls of a six-sided die, or 128 coin flips.
  • Coinkite replaced the backup random number generator, moving from Yasmarang to a SHA-256-based design.
  • Mk4 and Mk5 owners are being directed to install version 5.6.1, while Q model owners are being directed to install 1.5.1Q.
  • The release lands as AI-assisted security reviews gain momentum across bitcoin and crypto infrastructure.

Coldcard Releases Firmware After Major Bitcoin Theft

Coinkite, the Canadian company behind the Coldcard hardware wallet, has released new firmware after a randomness flaw exposed bitcoin holders to thefts totaling more than $114 million. The update is intended to address the flawed wallet behavior and strengthen several adjacent security areas, but it does not automatically repair wallets that may already be compromised.

For hardware wallet users, the distinction is critical. Firmware can patch the device going forward, but a seed already generated under affected conditions may remain unsafe. A seed is the master secret that controls access to a wallet’s coins. If that seed was produced using flawed randomness, attackers may be able to derive or guess it under certain circumstances, making a simple software update insufficient as a recovery measure.

Coinkite is telling affected users to create a new seed and move funds to a wallet secured by that fresh seed. The company has directed Mk4 and Mk5 device owners to install version 5.6.1 and owners of the newer Q model to install 1.5.1Q. Users are also being told to use only official downloads, a standard but important precaution because wallet firmware is a high-value target for attackers.

Why Updating Alone Does Not Secure an Affected Seed

The central issue is that a hardware wallet’s firmware and a wallet’s seed are not the same thing. Firmware controls how the device operates. The seed is the cryptographic root from which wallet keys are derived. If a wallet’s seed was created while the device was running affected firmware between 2021 and July 2026, updating the device may prevent future flawed seed generation, but it does not change the seed that already exists.

That is why fund migration remains the decisive safety step for affected users. A secure migration means generating a new seed under the corrected process and then sending funds from the old wallet to the new one. Until that is done, the funds may still depend on a secret that was created under conditions now considered unsafe.

This episode also highlights a recurring principle in bitcoin custody: self-custody removes dependence on third-party custodians, but it places operational responsibility on the user. Hardware wallets are designed to reduce attack surfaces by keeping private keys away from internet-connected machines, yet seed generation, firmware integrity and transaction verification remain essential parts of the security model.

New Seeds Require Physical Randomness

Coinkite has changed how new Coldcard seeds are generated. Each new seed now requires the user to supply physical randomness by hand. The device supports 65 key presses at unpredictable intervals, 50 rolls of a six-sided die, or 128 coin flips. The purpose is to ensure that the entropy used to create the seed comes from a process outside software control.

Physical randomness matters because a die roll or coin flip is not produced by code running on the device. The weakness behind the theft was tied to the device generating randomness by itself. By requiring direct user-supplied entropy, the new workflow reduces dependence on internal random generation and gives users a more transparent role in seed creation.

For less technical users, the process may feel more cumbersome than pressing a button and allowing a device to handle seed generation automatically. However, in high-value bitcoin custody, convenience often competes with assurance. The new design makes seed creation more deliberate, and it gives users a visible method for adding unpredictability before funds are secured.

Random Number Generator Replaced With SHA-256-Based Design

Under the hood, Coinkite replaced the backup random number generator entirely. The previous algorithm, Yasmarang, has been swapped for a design built on SHA-256, the hashing function used by bitcoin itself. SHA-256 is central to bitcoin’s proof-of-work and broader cryptographic architecture, making it a familiar primitive across the ecosystem.

The change does not mean every risk disappears. Security depends on implementation, review, hardware behavior and user practices, not a single named algorithm. Still, the replacement marks a clear shift away from the component associated with the original randomness problem and toward a better-known cryptographic building block.

Coinkite’s review also produced fixes outside the randomness pathway. The company identified and addressed issues in transaction approval, data handling over USB and firmware update validation. Those areas matter because a hardware wallet is only as secure as the entire path from seed creation to transaction signing and firmware maintenance.

Transaction Signing Gets Additional Protection

One of the most important changes concerns the moment just before a transaction is signed. The device now re-checks a transaction immediately before signing it. That step is designed to reduce the risk that a compromised computer, interacting through the USB port, could alter a payment after the owner had already approved it on the Coldcard screen.

Hardware wallets are built around the idea that users can verify transaction details on a trusted device even if the connected computer is unsafe. If malware can change transaction data after approval but before signing, that trust model is weakened. A final re-check directly before signing reinforces the approval flow and narrows the window for tampering.

Coinkite has also blocked by default signature modes that leave parts of a transaction editable after signing. That is another step aimed at limiting ambiguity in the signing process. For bitcoin users, especially those managing larger balances or complex transaction structures, predictable signing behavior is central to avoiding costly mistakes or malicious manipulation.

AI-Assisted Review Becomes a Security Theme

The Coldcard firmware release arrives during a broader move toward AI-assisted security review across bitcoin and crypto projects. Coinkite says it used AI tools, including Kimi and other frontier models, to examine the entire system rather than focusing only on the faulty randomness code. The result was a wider set of fixes than the original incident alone might have produced.

Other parts of the ecosystem are seeing similar shifts. BTCPay Server, free software used by merchants to accept bitcoin payments, was hit this month after attackers drained Lightning nodes through a flaw that had just been patched. The project is offering a bounty of up to 3 BTC for the return of the money and has paid 0.42 BTC to researchers who found the flaw. It has also advised merchants to keep funds in cold storage and regularly move excess funds out of hot wallets, especially during this period of rapid, AI-driven change.

Dozens of bitcoin firms, including Coinbase, Block, BitGo and Blockstream, signed an open letter on Aug. 10 asking AI labs to give open-source security researchers early access to their most capable models. The reasoning is straightforward: if AI systems can accelerate bug discovery, defenders want access before attackers are able to exploit the same capabilities at scale.

Bitcoin Red Team and Exchange Security Efforts Add Momentum

A volunteer initiative known as the Bitcoin Red Team has become one of the most visible examples of AI-assisted security work. The group, made up of sixteen developers working across time zones, filed 4,962 findings against 390 projects in its first 24 hours. Those findings included 85 critical and 635 high-severity issues, and the group produced the review that led to BTCPay’s patch.

Crypto exchange Bybit has also pointed to AI-assisted auditing as a major force in its security operations. The exchange, which lost roughly $1.46 billion to North Korea’s Lazarus Group in February 2025, said AI-assisted review found high-severity flaws at three to five times the rate of manual review. Bybit also said the approach helped it block $700 million in suspicious withdrawals across the first half of the year.

These examples suggest that AI is becoming part of the standard defensive toolkit rather than a novelty. It is not replacing human security teams, but it can broaden the search space, flag unusual patterns and help prioritize findings. At the same time, AI-generated output still requires human judgment, because false positives, incomplete reasoning and context errors can create their own risks.

What Coldcard Users Should Prioritize Now

For Coldcard users, the practical message is direct. Firmware should be updated to the relevant fixed release, but anyone with a seed created on affected firmware between 2021 and July 2026 should treat migration as the real security milestone. That means generating a new seed using the updated process and moving funds out of the old wallet.

Users should also be cautious during the update and migration process. Wallet firmware should be obtained only through official channels, transaction details should be checked carefully on the device screen, and backups should be handled in a way that avoids exposing the new seed to cameras, cloud services, connected devices or other digital storage. The safest wallet can be undermined if the recovery phrase is mishandled.

Law enforcement is still investigating the thefts and working to identify those responsible, according to Coinkite. The company has said it remains available to assist. For the broader bitcoin market, the incident is another reminder that custody infrastructure is part of the asset’s risk profile. Strong cryptography is essential, but secure implementation, transparent disclosure, rapid patching and disciplined user response are just as important.

Frequently Asked Questions (FAQs)

What happened with Coldcard wallets?

Coinkite released new firmware after a randomness flaw enabled attackers to steal more than $114 million in bitcoin from holders using affected Coldcard conditions.

Does the new firmware make a compromised wallet safe?

No. Installing the update does not make an existing compromised wallet safe if the seed was created on affected firmware between 2021 and July 2026. Those users still need to create a new seed and migrate funds.

Coinkite is directing Mk4 and Mk5 owners to install version 5.6.1 and owners of the newer Q model to install 1.5.1Q.

How do new Coldcard seeds generate randomness now?

New seeds require user-supplied physical randomness through 65 unpredictable key presses, 50 rolls of a six-sided die, or 128 coin flips.

Why is physical randomness important?

Physical randomness from dice, coins or unpredictable key presses is not generated solely by software. That matters because the theft was tied to a flaw in device-generated randomness.

What did Coinkite change inside the random number system?

Coinkite replaced the backup random number generator, moving from Yasmarang to a SHA-256-based design.

What other issues did the AI-assisted review find?

The review identified problems unrelated to the original randomness flaw, including issues involving transaction approval, USB data handling and firmware validation.

How is AI being used in bitcoin security?

AI-assisted reviews are being used to examine code, identify potential vulnerabilities and accelerate security triage across projects, exchanges and volunteer research efforts.

What should affected users do first?

Affected users should update to the appropriate fixed firmware, generate a new seed under the new process and move funds from the old wallet to the new wallet.

Photo by https://kaboompics.com/ on Pexels