Coldcard Users Advised to Move Bitcoin After Firmware Update

Coldcard Firmware Update: Critical Action Required

Coldcard has announced the release of firmware versions 5.6.1 and 1.5.1Q, following a security review that lasted three weeks. The company has warned users with affected seed phrases that they must create new wallets and transfer their Bitcoin.

Details of the Firmware Update

The latest firmware version 5.6.1 is applicable for Coldcard Mk4 and Mk5 devices, while version 1.5.1Q is intended for Coldcard Q units. The firmware update does not repair seed phrases created under earlier affected versions. Affected users must first update their devices, create and verify a new seed, and then ensure their Bitcoin is transferred to addresses linked to the new wallet.

Enhanced Seed Generation Process

This update introduces a new process for seed phrase creation, requiring input from the user to ensure greater security. Users must provide at least one source of randomness through a minimum of 65 key presses, 50 rolls of a six-sided die, or 128 coin flips. Coldcard emphasized that user-generated entropy is crucial to reduce reliance on a single component during seed creation.

Warning for Affected Users

Users who created seed phrases under vulnerable firmware versions should be vigilant. The company highlighted that merely updating the firmware will not repair existing weak seeds. It is important that affected users make this migration to safeguard their funds.

Redesigned Verification Processes

In addition to improvements in seed creation, the new firmware adds a staged verification process for partially signed Bitcoin transactions (PSBTs). This enhancement allows users to verify transaction data before signing, increasing security during the signing process. The update also addresses potential vulnerabilities related to device connections and firmware installation.

Background on the Seed Generation Flaw

This firmware update follows a past security issue that emerged in March 2021. An analysis revealed that certain firmware versions produced seeds with inadequate randomness, making them susceptible to potential attacks. Coldcard has been working on solutions since then to enhance the security of their devices and protect users’ assets.

Impact on Bitcoin Custody Choices

The Coldcard firmware incident has influenced how some Bitcoin owners perceive custody. Following the attack, there has been a notable surge in deposits to centralized exchanges as users seek to move their assets away from vulnerable devices. While this shifts the responsibility of seed generation, it places control in the hands of a third-party custodian, affecting the overall approach to Bitcoin ownership.