The Coldcard Q is Coinkite’s air gapped signer with a 50 key QWERTY keyboard, a QR scanner and dual microSD slots, listed at $319. Its own setup guide puts the firmware update before seed generation, and after the July 2026 entropy advisory that order is the difference between a 128 bit seed and a 72 bit one.
Listen to this article, about 12 minutes. A synthetic voice reads the article and announces each section title as it begins; tables are read row by row and the questions at the end are left out.
Recorded 1 October 2026 from the article as published that day. Press a chapter to jump there; the highlighted line is what is playing. A play button sits beside every section heading, and once you scroll past this player a bar at the bottom of the screen keeps the controls in reach. Tap or click any sentence to hear the reading start from there.
On this page: the Coinkite advisory and the vendor’s own Q release history read and dated on 30 September 2026, a seed overwrite fix merged two days ago that has not shipped yet, the air gapped signing steps taken from the documentation rather than a review, and what 37 reviews and three forum threads actually report.
Think you already know this? Five questions, one minute.
Every answer is on this page. Answer from what you know now; the page fills in the rest.
-
1. How many secure elements does the Coldcard Q use, and from how many manufacturers?
Coinkite’s hardware documentation names two secure elements from two vendors, Microchip’s ATECC608 and Maxim’s DS28C36B. The Q inherits the Mk4 arrangement rather than changing it. Read the section
-
2. How much entropy does Coinkite say pre-fix Q seeds actually carried?
The security advisory puts Mk4, Mk5 and Q seeds at “about 72 bits of entropy rather than the expected 128 bits” before the fixed releases. The roughly 40 bit figure is the one Coinkite gives for the Mk2 and Mk3. Read the section
-
3. Which standard Q firmware version does the advisory name as the floor for a trusted seed?
The advisory names 1.5.0Q for the Q and 5.6.0 for the Mk4 and Mk5. Read on 30 September 2026, the vendor’s Q release history carries no 1.5.0Q entry at all, running from 1.4.1Q straight to 1.5.1Q; the current release, 1.5.2Q, clears the floor either way. Read the section
-
4. Where does the documentation put Batch Sign PSBT on the Coldcard Q?
The microSD documentation puts Batch Sign PSBT under Advanced/Tools and then File Management. Firmware upgrades travel the same route, through Advanced/Tools, Upgrade Firmware, From MicroSD. Read the section
-
5. The Q shows a pair of anti-phishing words after your PIN prefix. What are they for?
Coinkite’s verification guidance says no two Coldcards produce the same word pair for the same prefix, and that unfamiliar words mean the device may have been tampered with or swapped. They are never any part of a seed or backup. Read the section
What is the Coldcard Q, and what comes in the box?
Coinkite’s documentation for the Q describes a 2.3 inch, 320 by 240 colour LCD, a 50 key QWERTY keyboard with dedicated QR and NFC keys, dual push-pull microSD slots, NFC-V, USB-C with a virtual disk mode emulating a 4MB drive, and power from three AAA cells or that same port. The QR scanner is a separate module at the top of the case, and what matters is how it is wired: Coinkite says it “connects to the Coldcard internally using a simple 2-wire serial port”, a much narrower path in than a camera stack.
Security wise, the Q is an Mk4 in a bigger case. The Mk4 itself has since left the Coinkite store but still receives the same releases, which our review of the Coldcard Mk4 after it stopped being sold direct sets out. The hardware documentation names two secure elements from two manufacturers, Microchip’s ATECC608 and Maxim’s DS28C36B, and the Q inherits that pairing rather than improving on it. The keyboard is the actual feature: a long BIP-39 passphrase on a two button device ends in a typo you cannot see. The Coinkite store listed the Q at $319, down from $369, and the Mk5 at $219 from $269, checked on 30 September 2026. Batteries and a USB cable are not included, which a surprising number of reviews leave out, possibly because they are describing a photograph. For the opposite design choice, our review of what Blockstream Jade’s blind oracle protects instead of a secure element works through a signer that ships with no secure element at all.
| Coldcard Q | Coldcard Mk5 | |
|---|---|---|
| Listed price, 30 Sep 2026 | $319, from $369 | $219, from $269 |
| Screen | 2.3 inch colour, 320 by 240 | Small mono OLED |
| Input | 50 key QWERTY keyboard | Numeric keypad |
| QR scanner | Yes, dedicated module on a 2-wire serial link | No |
| MicroSD slots | Two, push-pull | One |
| Power | 3x AAA cells or USB-C | USB only |
| Secure elements | Two, ATECC608 and DS28C36B | Two, same pairing |
| Current firmware | 1.5.2Q, 3 Sep 2026 | 5.6.2, 3 Sep 2026 |
Every figure there is from Coinkite’s own store and documentation. The two lines differ in input only. The part guarding the seed is identical.
Was the Coldcard Q affected by the seed entropy bug?
Yes. Coinkite’s security advisory, published on 30 July 2026 and updated on 1 August 2026, states that Mk4, Mk5 and Q devices generated seeds “with about 72 bits of entropy rather than the expected 128 bits” before the fixed releases. The firmware changelog is blunter: “Versions from 2021 to July 2026 had a bug which produced poor entropy. Any secrets generated on a COLDCARD in that period should be regenerated and funds moved on chain immediately.” The cause, a build error resolving a random number call to a software generator instead of the hardware one, is in the company’s backgrounder and in our piece on the Coldcard Mk3 seed flaw.
The sentence that governs everything else is the one owners skip. “Updating the firmware does not change or repair an existing seed.” A Q that generated its seed on any release before the fix carries that seed forward through every update afterwards, quietly. The advisory’s remediation order runs from confirming the fixed firmware to generating a new seed, verifying the backup and a receive address on screen, sending a test transaction, and only then moving the rest, keeping the old backup until the migration is confirmed.
What the advisory does not do is quantify what was lost. Public figures for the sweep that followed range from roughly 594 to over 1,100 bitcoin depending on who is counting, and none could be confirmed against a primary source here. The entropy figure and the version floors are documented, and those are the parts you can act on.
Which Coldcard Q firmware can a seed be trusted from?
The advisory names 1.5.0Q or later for standard Q firmware, and 6.6.0QX or later for the Edge builds. Reading the vendor’s own Q release history on 30 September 2026 complicates that. There is no 1.5.0Q entry in the file: it runs from 1.4.1Q on 1 July 2026 straight to 1.5.1Q on 20 August 2026, and 1.5.1Q is the release whose notes say master seed generation “now combines fresh entropy from the STM32 TRNG, SE1, and SE2”. The same file prints 1.4.0Q’s release date as 2065-03-05, a typo rather than a time machine.
That does not change what a Q owner does, because the current standard release is 1.5.2Q, dated 3 September 2026, which clears every floor the advisory names. But anyone checking a version against the vendor’s own history will not find the number the advisory gave them. The upgrade documentation separately asks you to verify the OpenPGP signature on the signed manifest and compare the firmware file’s SHA-256 hash against it before installing.
How does air gapped signing work on a Coldcard Q?
Two routes, both documented, neither needing a cable. The microSD route, per the microSD documentation, goes: your wallet software writes a PSBT file to the card, the card goes into the Q, you choose Batch Sign PSBT under Advanced/Tools and then File Management, the Q writes a signed PSBT back, and the card returns to the wallet software to broadcast. Firmware travels the same way, through Advanced/Tools, Upgrade Firmware, From MicroSD, which is what lets a Q be updated without USB ever touching it. The second slot earns its keep: one card holds the backup, the other carries transactions.
The QR route uses BBQr, an animated multi part format, read by that scanner module and shown back on the Q’s screen for the wallet software to read. Both routes are real air gaps. NFC and USB-C are not: they are conveniences the device offers and an air gapped setup declines, the same distinction our pieces on the Keystone hard wallet and the ELLIPAL air gap turn on.
One current caveat belongs here rather than in a footnote. On 28 September 2026 Coinkite merged a fix described this way: “Scanning seed words or an XPRV from Ready To Sign, or from the QR shortcut on Key Teleport’s Reuse Pubkey? screen, could overwrite an existing master seed.” It restricts signing scans to PSBTs and Teleport retries to Teleport payloads, and checks no master seed already exists before installing one. As of 30 September 2026 it is merged but not shipped, because 1.5.2Q predates it by five days. Until it ships, scanning an unexpected QR code at Ready To Sign is not a neutral act.
How do you check a Coldcard Q is genuine out of the box?
The bag comes first. Coinkite’s verification guidance prints the bag number in three places that all have to match, makes VOID appear across a broken seal, and puts the serial on a tear-off tab inside to check against the bag and the device screen. The checklist below is that sequence in order. Then the anti-phishing words: your PIN prefix produces a word pair unique to that device, shown before you enter the suffix. The point is not the words, it is the day they are wrong, when the suffix does not get typed.
Then the order, which is where most unboxing writeups get it backwards. The Q setup guide puts the firmware install after the PIN and before New Seed Words, telling the reader to “stop at the main menu before choosing a seed or restore option” first. Read in 2025 that is housekeeping. Read after July 2026 it is the whole entropy story in one step, and it is the step an affiliate review reverses, because an unboxing is a better story when it ends with a wallet than with a progress bar.
Verifying a Coldcard Q from the box, in the vendor’s own order
Every step below is taken from Coinkite’s published verification and setup guidance. It records nothing, it never asks you for a recovery phrase, and it says nothing about whether to buy anything.
Ticks are saved on this device only. This follows Coinkite’s published setup and verification steps and is general information, not financial advice.
What do Coldcard Q owners actually report?
For this article I read 37 reviews of coinkite.com on Trustpilot, scoring 2.3 out of 5 on 30 September 2026, and three bitcointalk threads running to 57 posts. These are accounts people posted, not verified findings, and no regulator or court record is involved in any of them.
The dates split the complaints in two. Before August 2026 the one star reviews are almost all logistics: a reviewer on 10 February 2026 paid $28.54 for shipping and then got a $51.25 FedEx customs invoice, and another on 7 September 2025 said a $1,500 express order had not shipped after 12 days of chasing. From 1 August 2026 the page fills instead with people reporting coins lost to weak seeds, one putting their own loss at over four bitcoin on 23 August 2026. Those are individual reports, not a measure of what the bug cost.
The most useful single account is older and much duller. In a bitcointalk thread running from 14 to 16 September 2024, an owner posting as Solo6R described a Q that went to a black screen after a firmware upgrade and backup restore, green light still on. Pulling the batteries, running on USB alone and loading a recovery image from microSD all did nothing. Coinkite shipped a replacement inside about one business day and did not ask for the dead unit back, which matters: it still held seed material, and a warranty process that wants the hardware posted back asks you to post your keys.
On the device itself, Mk4 owners weighing the upgrade in a September 2024 thread of 17 posts were unenthusiastic: bulky case, AAA cells next to USB-C recharging, a closed source QR module, BBQr not supported everywhere. Not one preferred the Q. Against that, accounts on 11 and 30 March 2026 from owners of both found them easy to use. Accounts and documentation agree on support, which replaces rather than repairs and does it quickly, and part on firmware confidence: that 2024 bricking came straight after an upgrade, which argues for updating a Q while it is still empty, the order the setup guide already asks for. A verified, offline recovery phrase is what makes a dead screen an inconvenience instead of a disaster.
Frequently asked questions
Does a Coldcard Q need a computer to work?
Not to sign. It runs from three AAA cells or USB-C power, and a transaction can cross to it and back entirely by microSD card or animated QR code. A computer running wallet software still builds the transaction and broadcasts it, but it never has to be connected to the device.
Can a Coldcard Q run without batteries?
Yes, it powers from the USB-C port. Coinkite notes that the AAA cells will not drain while the device is stored. Batteries and a cable are not supplied in the box, so a first session needs one or the other to hand.
Is the Coldcard Q open source?
The firmware is published, which is how the release history and the individual fixes quoted in this article can be read at all. The QR scanner module is not open, and forum posters raise that as a limitation; it connects over a two wire serial link rather than as a general camera.
What is Key Teleport on the Coldcard Q?
A feature added in 1.3.2Q on 16 April 2025 for moving seed or backup material between devices by QR or NFC. Its retry shortcut is one of the two screens covered by the QR handling fix merged on 28 September 2026.
How many seed words does a Coldcard Q generate?
The setup guide offers a choice of 12 or 24 words at the New Seed Words step, and requires one entropy contribution from the owner, by mashing keys, dice rolls or coin flips, before it writes the seed.
Is a Coldcard Q more secure than an Mk5?
Not in the part that guards the secret. Both use the same pair of secure elements from the same two manufacturers and share a security model. The Q’s advantages are a readable screen, a keyboard for long passphrases and a camera, all of which make verification easier rather than the chip stronger.
Finished the page? The same five questions from the top, to see what stuck.
This article is educational and is not financial advice. Nothing here is a recommendation to buy, sell or hold anything. You are responsible for your own security decisions.
Leave a Reply