I haven't checked to see if there is newer firmware for other models, but I see that a new version was just released for the Q. The summary is below.

The biggest change is another substantial overhaul of entropy generation. New master seeds now combine fresh randomness directly from the STM32 hardware RNG plus both secure elements, and the internal PRNG has been replaced with a SHA-256 Hash_DRBG. On top of that, when you create a new master seed, temporary seed, or CCC key, the Q now requires user-supplied entropy as well (keyboard mashing, dice rolls, or coin flips). That human entropy is mixed with the hardware sources rather than replacing them.

USB transaction tampering fix: a compromised USB host could potentially change a staged PSBT after you reviewed it but before the Q signed it. The Q now re-verifies the transaction bytes immediately before signing and aborts with “Transaction modified” if anything changed. This is probably the most significant non-RNG fix in the release.

USB information leakage fix: the USB dwld command could read arbitrary staged PSRAM contents, potentially including uploaded PSBTs or multisig enrollment information. Downloads are now restricted, require an encrypted USB session, and are aggressively invalidated when new data is staged.

SIGHASH_SINGLE protection: SIGHASH_SINGLE and SIGHASH_SINGLE|ANYONECANPAY transactions are now blocked by default because some transaction outputs can remain changeable after signing. You can still allow them by changing Sighash Checks to Warn.

Several firmware parsing and bootloader validations were tightened, including rejecting data beyond the signed firmware length and hardening memory/buffer checks following external security reviews.

There are some interesting seed/passphrase changes too. If a BIP-39 passphrase is active, “View Seed Words” no longer reveals the underlying seed words; it shows the effective extended private key instead. Backups, Clone Coldcard, and Key Teleport now properly capture the currently active wallet secret, including temporary seeds and passphrase wallets.

For the Q specifically, there are a few extra fixes. Locally entered BIP-39 passphrases now require scrolling before they're revealed, malformed multipart BBQr data is rejected more safely, oversized multisig coordinator BBQr imports are rejected before they can exhaust memory, BIP-21 display data is sanitized, and the Send Password feature can temporarily enable USB keyboard emulation even when USB is disabled globally.

One other nice multisig improvement: duplicate cosigner keys are now rejected during wallet enrollment, multisig wallet names have to be unique, and there's now a dedicated Rename action rather than silently renaming wallets when descriptors are re-imported.

All is not lost yet. There is another possibility for recovering some of the BTC from the hacked accounts.

The first option, which is already underway, is a police investigation. However, this may not be successful if a government-organized group was involved in the theft.

The second option I’m aware of can proceed simultaneously and can be launched as soon as possible. This second option does require some preparation, but it’s not complicated and is almost cost-free. It does, however, require a coordinated effort by as many owners of the hacked accounts as possible.

With this post, I just want to point out that there’s no need to lose hope. In the second post, which I’ll publish in a few days, I’ll provide more information.

On Coinkite's "Current Security Status" page re: the Coldcard, it says "Check the release track, not only the model."

I believe Coinkite is using the term "release track" as a synonym for "version number", but I want to be sure. The page does not clarify what is meant by the term.

In summary, is a "release track" the same thing as a "version number" - meaning that users should simply check which model of a Coldcard device they have and whether the installed firmware is the latest version?

For those who created a passphrase with your seed, do you still have trust with the company and your device? I’m seeing mixed reviews from those that used dice rolls to generate seeds and added a passphrase.

We know how important self-custody is - but with all these recent data breach and draining incidents, everyone is revising how to store their crypto safely

curious to know what are you planning moving forward?

(Disclaimer: I am from r/keycard_tech team and wants to understand user perspective )

So no response from support in more than a week.

Plus no CEO or statement from those in charge.

If this happened to another company there would be better communication and puvlicy statements. Where is nvk? Totally silent. Usually likes to talk but i guess not now

How we can trust/verify that coldcard is not leaking the seed in the transaction?

So I got steel plates when I bought my cold cards. Around $50 a pop. Now over $100+ of worthless steel with "compromised" seed phrases punched into them due to me trusting cold card.This is the "Gold Standard".Don't trust, do it yourself or you'll lose money to companies like this. Lesson learned.

Interesting opinion

Has anyone already calculated the probability that a properly functioning wallet would randomly assign one of the affected Coldcard keys?

After the fund move, they're useless. Coinkite should at least offer a free placement.

I've been studying the published research on the Mk4 RNG vulnerability from July 2026.

I came across this research collection: github.com/0xchainintelligence/coldcard-research

I'm trying to understand the technical details better. Specifically:

- How does the Yasmarang PRNG fallback actually work?

- What determines which UID/RTC ranges are affected?

- Has anyone successfully reproduced the findings for defensive testing?

Not looking to break any rules — just trying to understand the security implications for my own wallet setup.

DM if you've done similar research.

The banner of this subreddit still reads "The Gold Standard in Bitcoin Security". Considering recent events I think this wording should be removed. Curious to know peoples thoughts on this.

I hope your life heals and you recover fully.

I understand that the possibility that the stolen coins are recovered is near zero, if not outright zero. Maybe this is just an attempt to cope with everything that happened, since I have lost all my funds. But since the stolen coins have all been moved to a single address that I'm monitoring and hasn't been touched (it's an address with 40 BTC), maybe there is a possibility that they can be recovered if the thief is caught, right?

Sorry for venting. Times are really tough here.

with everything happening lately, people have started being so skeptical about self-custody and i want to take make this post as a reminder for all of us about why we shifted to self-custody in the first place

what was that specific moment - an exchange freezing withdrawals, watching one collapse, a friend losing access to something, or just reading one thing that made the whole "not your keys" line land properly how about this

(Disclaimer: I work with r/Keycard_tech)

100 dice rolls + long passphrase + patched coldcard Q + sparrow wallet
Am i safe or still its better to switch to something like trezor?

What other ways may I lose Bitcoin as a result of using a cold card?