The hardware wallet maker said users should create new seed phrases, move bitcoin to newly generated wallets and update firmware as it works on a further patch to strengthen recovery from TRNG errors.
Coldcard has renewed a high-priority warning over a continuing security issue tied to its key generation process, telling users to move bitcoin to newly created wallets and generate entirely new seed phrases. The company said the vulnerability, which it linked to roughly $40 million in losses, remains an active risk and that users should also update firmware and stop using addresses created with outdated derivation methods to reduce the chance of unauthorized transfers. Coldcard also pushed back on claims that its latest firmware permanently bricks devices. It said a temporary TRNG error should normally be resolved by fully disconnecting the device from power and restarting it, with no data written to flash memory during the shutdown. Developers said they are preparing another patch based on STMicroelectronics' documented recovery procedure, adding safeguards including limited retries, seed error detection and deletion of old random-number outputs after recovery. Support for Coldcard Mk3 devices is slated for a separate software update.