COLDCARD vulnerability what happened, and what to do
Informational only, and this site never asks for your recovery words. details

Informational only. This is independent analysis and an evidence-backed explainer, not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite, Block, or any other party named here. Published estimates are attributed, and differing scenarios are kept separate with their assumptions. Act on your own judgement. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it. Deliberate recovery on independently verified offline equipment is a separate operation. Seed-word safety.

COLDCARD entropy FAQ

coldcard-docs-faq

https://coldcard.com/docs/faq/

Organisation
Coinkite
Evidence role
Vendor documentation
Published
not established
Source changes
0
Detected differences
1
Unreviewed
0
Copies held
2

The pre-incident entropy description: hardware TRNG from transistor noise, a PRNG XOR'd into it, SE1/SE2 boot seeding, SHA-256 whitening, and the line that dice add "to the 256 bits of entropy already picked". Quoted on /how-it-broke/promised/ to compare stated design against what shipped. It is monitored closely because it describes the affected subsystem. The first capture is post-disclosure and does not establish the page's earlier wording.

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked 2 Aug 2026, 01:00 UTC.

  1. capture noise difference between 1 Aug 2026, 03:51 UTC and 1 Aug 2026, 07:01 UTC Current capture noise +1 -1

    Only the FAQ footer's Last update date changed from July 31 to August 1; no extracted FAQ answer changed.

    seen 1 Aug 2026, 07:01 UTC · Captured here text sha256 f0fb64288e37ad67f771d689 17,625 chars
    What changed from the previous capture 2 lines
     our online docs. and ultimately
     the COLDCARD source code.
     Last update:
    -July 31, 2026
    +August 1, 2026
     Back to top
     Copyright © Coinkite Inc. All rights reserved.
    
    Extracted text as captured
    Skip to content
    COLDCARD Documentation
    COLDCARD FAQ
    Initializing search
    Documentation
    COLDCARD Home
    Buy Now!
    COLDCARD Documentation
    Documentation
    Documentation
    Guides
    Guides
    Getting Started
    Getting Started
    Quickstart! Start Here!
    Q Quickstart Guide
    Guide For Bitcoin Beginners
    PINs
    Master Seed
    Ready To Sign?
    Sending and Receiving Bitcoin for Beginners
    COLDCARD Ultra Quick Guide
    COLDCARD Middle Ground Guide
    COLDCARD Paranoid Guide
    General
    General
    Upgrade Firmware
    Settings Menu
    Address Explorer
    Verify Address Ownership
    QR Scanner
    Encrypted Backups
    NFC Tools
    Secure Notes & Passwords
    Multisig Features
    Airgap Multisig
    Seed Management
    Seed Management
    Generate Seed
    Generate Seed

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  2. Earliest copy held
    seen 1 Aug 2026, 03:51 UTC · Captured here text sha256 aefae88dc22aaf006134c1ac 17,624 chars
    Extracted text as captured
    Skip to content
    COLDCARD Documentation
    COLDCARD FAQ
    Initializing search
    Documentation
    COLDCARD Home
    Buy Now!
    COLDCARD Documentation
    Documentation
    Documentation
    Guides
    Guides
    Getting Started
    Getting Started
    Quickstart! Start Here!
    Q Quickstart Guide
    Guide For Bitcoin Beginners
    PINs
    Master Seed
    Ready To Sign?
    Sending and Receiving Bitcoin for Beginners
    COLDCARD Ultra Quick Guide
    COLDCARD Middle Ground Guide
    COLDCARD Paranoid Guide
    General
    General
    Upgrade Firmware
    Settings Menu
    Address Explorer
    Verify Address Ownership
    QR Scanner
    Encrypted Backups
    NFC Tools
    Secure Notes & Passwords
    Multisig Features
    Airgap Multisig
    Seed Management
    Seed Management
    Generate Seed
    Generate Seed

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

How to check this yourself

Each copy above is identified by the SHA-256 of its extracted text, shown beside it, and the diffs are plain unified diffs. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.