Coldcard Mk3: The Seed Flaw and What the Fix Misses

Coldcard Mk3 seeds generated on firmware 4.0.1 through 4.1.9, from March 2021 to July 2026, came from about 40 bits of entropy instead of 128, by Coinkite’s own estimate, unless you added your own dice rolls. Installing 4.2.0 does not repair an existing seed, and it is the final Mk3 release.

On this page: Coinkite’s own 40 bit estimate quoted from its technical backgrounder, a release table showing the two security updates the Mk3 never received, about 25 dated owner accounts from Bitcointalk, and a checklist you can run without ever typing a recovery word.

What actually went wrong with Coldcard Mk3 seed generation?

A hardware wallet has one job that nothing else can do for it: pick a number nobody can guess. On 30 July 2026 Coinkite published a security advisory saying that its own devices had been doing that job badly since March 2021. The company’s technical backgrounder is unusually plain about the cause. During a migration to its libNgU library, seed generation started calling ngu.random.bytes(), and a build and link error meant the symbol resolved to MicroPython’s software PRNG rather than the chip’s hardware random number generator. The switch meant to disable the software path, Coinkite writes, “did not have the intended effect”.

The result is not a broken chip. It is a broken wire between two working parts. Coinkite estimates the effective search space at about 40 bits on Mk2 and Mk3, against the 128 a seed is supposed to carry. Forty bits is roughly a trillion possibilities, which sounds enormous until you remember that a graphics card does not get bored.

Coinkite is also clear about what did not happen, and the distinction matters for anyone deciding whether a device on a shelf is now radioactive. On its security page the company says the devices “were not hacked, remotely accessed, or taken over”, and that attackers regenerated the private keys offline. Nobody had to touch your Mk3. They only had to guess what it had already chosen. If you want the wider picture of why an offline device is still only one layer, our piece on what a cold wallet actually protects covers the rest of the stack.

The Block reported on 30 July 2026 that 594.5 BTC, about 38.3 million dollars, left roughly 500 addresses in one coordinated sweep, with later waves following. The affiliate reviews at the top of this search have not been updated since, which is how a device keeps getting recommended for a property it no longer had.

Does installing 4.2.0 make an old Mk3 seed safe?

No, and this is the single most misread part of the whole episode. Coinkite’s own upgrade documentation puts it plainly: updating changes the device software, it does not alter an existing seed. A firmware update fixes the factory. It does not go back and remake the thing the factory already shipped.

So the question is not what version your Mk3 runs today. It is what version it was running on the day the seed was first created. If those words were generated on 4.0.1 or later and you added nothing of your own, they came out of the weak path, and they are still the same words now that the device is patched.

Two things break that chain, and both are in the advisory. If you added at least 50 fair, independent, private dice rolls when you created the seed, Coinkite says it does not consider that seed at risk from this issue alone. If the funds sit behind a strong, unique BIP-39 passphrase, an attacker has to guess the weak seed and the passphrase together. Neither is a loophole to lean on if you are not certain which you did. Uncertainty here is an answer, and the answer is the cautious one. The ways people actually lose a recovery phrase has more on why written records of what you did at setup are worth keeping.

Coinkite’s published migration sequence is to install the fixed firmware, generate a new seed on updated hardware, verify the backup and the receive addresses, send a small test transaction, then move the rest and keep the old backup until the migration is confirmed. That is custody housekeeping, not a trade.

Is the Coldcard Mk3 still supported, and what does 4.2.0 leave out?

Here is the part no ranking page for this query currently says out loud. The Mk3 was fixed, and then the fixing carried on somewhere else. Coinkite’s Mk3 and Mk2 downloads page, read on 25 September 2026, lists 4.2.0 dated 2026-07-31 and labels it the final release for the line. Two further security releases shipped after it, and neither was for the Mk3.

The 4 September release is the one that stings. It ships verify_seed_mix.py, which Coinkite describes as a dependency free tool that recomputes a finished 12 or 24 word seed from the displayed device words and your full dice or coin sequence. That is the answer to the question this incident raised: prove to me the device mixed my entropy in properly. An Mk3 owner cannot run that check on an Mk3, because the firmware producing the values to check against ends at 4.2.0.

None of that makes an Mk3 dangerous to hold today with a freshly generated seed on 4.2.0. It makes it a device with a closed roadmap, which is a perfectly ordinary thing to own as long as you know you own it. The Tangem cards have no firmware updates at all, by design, and that is a deliberate tradeoff rather than an accident.

What do Coldcard owners themselves report?

We read about 25 posts across three pages of the main Bitcointalk thread tracking the compromise, opened on 30 July 2026. Every account below is paraphrased, dated and attributed to that thread. It is testimony, not evidence, and none of it is independently verified.

The technical reading arrived before the vendor’s did. On 30 and 31 July 2026 the developer posting as gmaxwell traced the failure to inconsistent build directives leaving the device on MicroPython’s fallback generator, seeded from little more than a hardware identifier and a timer. That matches, in substance, what Coinkite published in its own backgrounder the same week.

One poster, using the name ColdcardVictim, wrote on 31 July 2026 that they had lost 1.8 BTC and were posting partly in the hope of reaching whoever took it. That is the only self reported loss we found in the thread, and it cannot be checked. Against it sits mr.mister, the same day, reporting a Mk4 and a Q both set up with what they describe as sufficient dice rolls, apparently unaffected, and still weighing whether to stay with the brand at all. A poster called LoyceV noticed something the coverage mostly skipped: the sweeping transactions appeared to leave addresses under roughly 0.15 BTC alone, which is the behaviour of someone optimising fees, not someone in a hurry.

The range cuts both ways. One long standing member, dkbit98, argued the episode showed a broader collapse of confidence in the company rather than one bug. Another, philipma1957, said the news pushed him to sell part of his holdings, which is a reaction to fear rather than a security measure, and this site has nothing to say about anyone’s buying or selling. Several posters simply restated the oldest advice in self custody, which is to supply your own entropy and not take the device’s word for it.

Where the accounts and the official guidance agree: dice rolls and a passphrase were what separated the people who shrugged from the people who did not. Where they part company: the advisory treats this as a firmware defect with a firmware answer, while the thread treats it as a reason to distrust any single vendor’s randomness, Coinkite’s included. Our comparison of Trezor and Ledger makes the same point about relying on one company’s claims.

What is the real risk of buying a secondhand Coldcard Mk3?

It has almost nothing to do with the price and everything to do with who saw the words first. Ledger documents a real case of a secondhand Nano S sold with its 24 words supplied: the buyer funded it, and the seller, who still had a copy, emptied it. The device was genuine. The packaging was irrelevant. The phrase was the whole attack.

A legitimate hardware wallet never arrives with a recovery phrase already written down, on a card, in the manual or read out by a helpful seller. If one does, the correct number of coins to send it is zero, forever. No amount of factory resetting makes a supplied phrase safe, because the phrase is the account.

On top of that universal rule, a used Mk3 carries two specific problems. The first is that whatever seed is on it was almost certainly created during the affected window, so it is weak entropy and a stranger’s memory at the same time. The second is that the usual reassurance, the numbered tamper evident bag, is designed for a device shipped from Coinkite. On its security page the company says the bag and the clear case do not “replace buying from a known source or checking the device at first use”. The same applies to an Mk4 offered secondhand, now that Coinkite no longer lists it, as our Coldcard Mk4 review covering its firmware and the July seed advisory explains. A resealed bag from a private seller proves nothing at all. If the answer is a new device instead of a used one, the current model carries its own advisory history, which we read and dated in our review of the Coldcard Q and the firmware order it depends on.

A known source is not a guarantee either, and October 2026 showed why. On 9 October 2026 Ledger began investigating drained wallets among people who had bought from CryptoBilis, its authorised reseller in South East Asia, and in its 72 hour update said every confirmed case traced to devices sold through that one reseller, with one device found to carry an unauthorised hardware implant, as Decrypt reported. That case involves Ledger devices, not Coldcard, but the lesson travels: an authorised reseller is a shorter supply chain than a stranger on a forum, not a sealed one. Buying from the maker itself and checking the device at first use are the parts of the advice that no reseller badge can stand in for. We set out what that case means for buyers in our comparison of five Ledger devices and the reseller risk.

How do you check an Mk3 you already own?

The version is four button presses away. Coinkite’s documentation gives the path as Advanced/Tools, then Upgrade Firmware, then Show Version. Read it before you do anything else, and write it down, because the number you need is the one from setup day and this is the closest thing you have to a record.

Two warnings from the same page, both worth taking literally. Do not downgrade unless you have a specific reason, and if the device reports itself as a Mark 1, stop: firmware newer than 3.0.6 will brick it.

One more, which is ours rather than Coinkite’s. Nothing in this process ever requires your recovery words to be typed into a screen that is not the device itself. No site checks a seed for weak entropy. No support agent needs to see it. In the weeks after an incident like this the phishing is more dangerous than the bug, because the bug at least has a published fix. For the general version of that argument, see why storage is a setup rather than a device.

What has changed since this was first published?

• Rechecked on 18 October 2026: the Mk3 and Mk2 downloads page still lists 4.2.0, dated 31 July 2026, as the final release for the line, and every build from 4.0.1 to 4.1.9 is still flagged with the seed generation warning. Nothing new has shipped for the Mk3 since we first read the page on 25 September 2026.
• As of October 2026 a search turned up no Coldcard release newer than the 4 September 2026 versions in the table above, so the gap between the Mk3 and the current models is the same two security releases it was in September.
• Added in October 2026: the reseller caveat above the version check, after Ledger’s investigation into devices sold by CryptoBilis, which began on 9 October 2026, per The Block. Loss estimates in that case come from onchain researchers and had not been confirmed by Ledger when we checked.

Frequently asked questions

This article is educational and is not financial advice. Nothing here is a recommendation to buy, sell or hold anything. You are responsible for your own security decisions.