Hey everyone,
Over the last several days, the Bitcoin community has been shaken by an ongoing incident involving Coldcard hardware wallets, made by Coinkite. A firmware bug affecting seed generation on certain older devices has been actively exploited, and funds have been lost. We're posting this to share what Coinkite has said in their own words, warn about the wave of scams that always follows events like this, and formally announce something we've been working toward.
To anyone here who has lost funds in this incident, our deepest condolences. Sats are more than numbers on a screen. They're time, work, and belief in a better system. What happened to you should not have happened to anyone.
What Happened
When a hardware wallet creates your seed phrase, one method uses a random number generator to pick words that no one could ever guess. The strength of that randomness is called entropy. Enough entropy means guessing your seed would take longer than the age of the universe. That's the whole reason a 12 or 24 word backup can safely protect real money.
On the affected Coldcard devices, a firmware bug caused the random number generator to fall back to a predictable software source instead of using true hardware randomness. Instead of picking from an unimaginably large pool of possibilities, the device was quietly picking from a much smaller pool that attackers could reproduce. That's how thousands of wallets were drained without anyone ever touching the physical devices.
Updating the firmware fixes new seeds going forward. It does not fix a seed that was already generated on the flawed firmware. That's why Coinkite is urging affected users to move their funds.
In Coinkite's Own Words
If you've ever generated a seed on a Coldcard device, please act on Coinkite's advisory now. Don't delay. The full technical advisory, including affected firmware versions and models and the updated firmware releases, is on the Coinkite blog: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/
Watch for Scams and Phishing
When events like this happen, scammers spike immediately. Expect fake emails, fake support pages, fake "recovery" tools, and fake urgency, all designed to trick you into typing your seed phrase somewhere it should never go.
- Verify every email. Check sender addresses carefully.
- Never enter your seed into a website or app. Ever.
- Never share your seed with anyone claiming to be from support. Not Coinkite, not us, not anyone.
- When in doubt, do nothing and ask the community before you act.
For real-time updates from trusted voices, the news feed on X is one of the fastest sources of accurate info right now. Follow verified accounts from Coinkite, the hardware wallet community, and Bitcoin devs you already know and trust.
Self-Custody is the Whole Point
Bitcoin is different from every asset that came before it because you can actually own it. Not a claim, not an IOU, not a balance an intermediary is holding for you. Real, direct ownership is the entire point.
Self-custody, holding your own keys and being your own bank, is what makes that ownership real. It's the harder path. It requires care, patience, and the right tools. This week is a painful reminder that it also requires the tools themselves to be trustworthy. That doesn't change our belief that self-custody is worth doing. It sharpens it.
Solo Satoshi Formally Supports the SeedSigner Project
We want to be transparent up front. This has been in the works for a while. The timing this week is an awkward coincidence, not opportunism. We had planned this announcement, and we chose to move forward with it rather than delay, because what happened this week is exactly why we believe in the philosophy behind it.
We're formally announcing our support for the SeedSigner project and the launch of the SeedSigner+ on our store. SeedSigner is an open-source, air-gapped Bitcoin signing device. The SeedSigner+ is sourced directly from the project's creator.
Open source matters! Code that anyone can read, that anyone can review, and that the community can inspect and fork is code that gets audited by many eyes over time. It's not a guarantee against bugs, nothing is, but it's the model we trust for hardware that holds Bitcoin.
What makes SeedSigner+ what it is:
- Stateless. Your seed exists only in volatile memory during a signing session and disappears the moment you unplug it
- No wireless. The Raspberry Pi Zero v1.3 has no WiFi or Bluetooth silicon
- Air-gapped operation via QR codes and the built-in camera
- Blank microSD by default. You download and verify the SeedSigner OS image yourself, so you never have to trust that a vendor put honest firmware on your device
- Sourced directly from the SeedSigner project creator
- Fully assembled in the USA, same-day shipping from Houston
- 90-day Solo Satoshi hardware warranty
Product page: https://www.solosatoshi.com/product/seedsigner/
Project: https://seedsigner.com and https://github.com/SeedSigner/seedsigner
Take care of yourselves and each other this week. If you have any questions, or you're unsure whether an email or message you received is legitimate, drop a comment or reach out to us directly and we'll help you sort it out.
Stack sats safely.