Passport is not affected

 qna:
 We plan to allow for manual firmware updates outside of Envoy yes.
 When?
+qna
+August 1, 2026, 10:24am
+5
+This is currently scheduled for the next but one release, but our roadmap is always subject to change and as of right now, I do not have definitive time frame for this.
 Home

Organisation

Foundation

Evidence role

Vendor statement

Published

2026-07-31

Source changes

1

Detected differences

2

Unreviewed

0

Copies held

3

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked 15 Aug 2026, 12:53 UTC.

1. capture correction difference between 1 Aug 2026, 16:09 UTC and 3 Aug 2026, 02:34 UTC Current capture correction +0 -66

   The HTTP capture received Discourse's 173 KB JavaScript application shell instead of the 32 KB crawler-rendered page the extractor reads, so extraction returned empty while the post itself remains present in the served page metadata. The publisher did not remove the statement.

   seen 3 Aug 2026, 02:34 UTC · Captured here 0 chars
   What changed from the previous capture 66 lines

   -Foundation Community
   -IMPORTANT - Passport is NOT affected by the Coldcard seed vulnerability
   -General
   -qna
   -July 31, 2026, 9:08am
   -1
   -A serious flaw in Coldcard’s seed generation was disclosed on 30 July, and funds are being stolen as a result. Here is where Passport stands.
   -Seeds generated by a Passport are not affected. Passport Prime and Passport Core both use different code, and neither has ever contained this flaw.
   -One important qualification. If you imported a seed that was originally created on an affected Coldcard into your Passport, that seed is still affected. Moving a seed to a different device does not repair it, because the problem is in how the seed was created, not where it now lives. The same applies if an affected Coldcard key is one of the keys in a multisig setup. If that describes you, read Coinkite’s advisory below and treat it as urgent.
   -If you own a Coldcard at all, go and read Coinkite’s advisory before anything else. It is time sensitive.
   -And please read the section on scams at the bottom before you act on anything. A lot of the losses that follow an incident like this come from the scams around it rather than the original problem.
   -What happened
   -Every Bitcoin wallet starts with a seed, and its security depends completely on that seed being unpredictable. If the randomness behind it is weak, everything built on top of it is weak too.
   -In March 2021 Coldcard changed the code behind its seed generation. A check that was meant to guarantee the device’s hardware randomness was being used did not work as intended, and the firmware was instead built to use ordinary software randomness, calculated from predictable values like part of the chip’s fixed identifier and some timing registers. The hardware randomness was still there on the chip. That code path simply stopped using it.
   -The result is that the range of seeds a Coldcard could produce was drastically narrower than it should have been. How much narrower depends on the model and firmware, and how hard the seeds are to recover varies with it, but Coinkite now describes affected seeds as having around 72 bits of protection instead of the expected 128. That is a serious reduction, and it is being actively exploited.
   -The two accounts worth reading:
   -Coinkite’s advisory, the manufacturer’s own, which is being updated as they learn more
   -Block’s technical analysis, the most thorough public writeup so far
   -Coinkite’s advisory currently covers Mk3 from firmware 4.0.1, Mk4 and Mk5 before 5.6.0, and Q before 1.5.0Q. Block additionally identifies affected Mk2 firmware. Check the advisory directly rather than relying on this summary, since the scope has already widened once.
   -Two things worth understanding if you own one. What matters is the firmware that was running when the seed was created, not when you bought the device, and not which wallet holds it today. And updating your firmware does not fix an existing seed. Recovering from this means generating a new seed and moving your funds to it.
   -Coinkite also has guidance on where dice rolls or a strong passphrase change the picture. Read it there rather than taking a rule of thumb from us.
   -Why Passport-generated seeds are not affected
   -Passport does not use the Coldcard code involved in this.
   -Both Passport Core and Passport Prime generate seeds by combining multiple independent hardware sources, including our avalanche noise circuit, a physical component on the board built specifically to produce randomness.
   -The published seed generation code on both devices uses those hardware sources. It does not fall back to a serial number, a device identifier, a timer or a clock.
   -Checking rather than trusting
   -You do not have to take the above on our word, and we would rather you did not.
   -Our firmware is open source, so you can read the code that creates your seed yourself. Both devices also have a documented reproducible build process, so you can build a release from source and confirm it matches the binary we published. Passport Core’s is at REPRODUCIBILITY.md and Passport Prime’s is in the KeyOS repository.
   -Independent security audits of both Passport Core and Passport Prime are published in full, along with our responses to them, at foundation.xyz/security.
   -Please be careful of scammers
   -This is the part we would most like you to take away.
   -Scammers are always circling, but when something high profile happens they go into overdrive, because they know a lot of people are suddenly worried, confused and in a hurry. Assume anyone who contacts you out of the blue about your wallet is a scammer until proven otherwise.
   -To be completely clear about how we operate:
   -Foundation will never ask for your seed words, recovery phrase, private keys, passphrase or PIN. Not by email, not on the forum, not in a support ticket, not on a call. There is no situation in which we need them.
   -We will never ask you to type your recovery phrase into a website, a form, an app or a support tool.
   -We will never contact you unexpectedly about your wallet, and we will never ask you to move your funds.
   -We will never ask you to share your screen or install remote access software.
   -If someone is pressuring you to act quickly, telling you your funds are at risk and they can help, offering a “recovery service”, or asking you to verify your seed somewhere, stop and do nothing. That is the scam.
   -Be especially wary of direct messages, of people claiming to be Foundation or Coinkite staff, and of search results and sponsored links for wallet software. Only download software from the official source, and take a moment to check the address you are typing.
   -If you do need to move funds because of this, there is no prize for speed over care. Take your time, verify addresses on your device screen, and if anything feels off, ask here in public rather than in a private message.
   -Questions
   -If you have questions about how your Passport creates and protects your seed, ask below and we will answer them.
   -search
   -July 31, 2026, 1:23pm
   -2
   -Do you still plane on giving us the option to make the Prime into an air gapped device? I would like ability to update via USB C port with a micro SD card and preform transactions with QR code. If so when do you plan on rolling this out?
   -qna
   -July 31, 2026, 2:17pm
   -3
   -We plan to allow for manual firmware updates outside of Envoy yes. You are also free to disable all other communications and sign via QR code with another software wallet like Sparrow.
   -search
   -August 1, 2026, 12:02am
   -4
   -qna:
   -We plan to allow for manual firmware updates outside of Envoy yes.
   -When?
   -qna
   -August 1, 2026, 10:24am
   -5
   -This is currently scheduled for the next but one release, but our roadmap is always subject to change and as of right now, I do not have definitive time frame for this.
   -Home
   -Categories
   -Guidelines
   -Terms of Service
   -Privacy Policy
   -Powered by Discourse, best viewed with JavaScript enabled
   

   Extracted text as captured

2. source content difference between 1 Aug 2026, 00:46 UTC and 1 Aug 2026, 16:09 UTC source content +4 -0

   Foundation added a reply to the thread saying manual firmware updates outside Envoy are scheduled for the next but one release, with no definitive timeframe committed.

   seen 1 Aug 2026, 16:09 UTC · Captured here 6,855 chars
   What changed from the previous capture 4 lines

    qna:
    We plan to allow for manual firmware updates outside of Envoy yes.
    When?
   +qna
   +August 1, 2026, 10:24am
   +5
   +This is currently scheduled for the next but one release, but our roadmap is always subject to change and as of right now, I do not have definitive time frame for this.
    Home
    Categories
    Guidelines
   

   Extracted text as captured

   Foundation Community
   IMPORTANT - Passport is NOT affected by the Coldcard seed vulnerability
   General
   qna
   July 31, 2026, 9:08am
   1
   A serious flaw in Coldcard’s seed generation was disclosed on 30 July, and funds are being stolen as a result. Here is where Passport stands.
   Seeds generated by a Passport are not affected. Passport Prime and Passport Core both use different code, and neither has ever contained this flaw.
   One important qualification. If you imported a seed that was originally created on an affected Coldcard into your Passport, that seed is still affected. Moving a seed to a different device does not repair it, because the problem is in how the seed was created, not where it now lives. The same applies if an affected Coldcard key is one of the keys in a multisig setup. If that describes you, read Coinkite’s advisory below and treat it as urgent.
   If you own a Coldcard at all, go and read Coinkite’s advisory before anything else. It is time sensitive.
   And please read the section on scams at the bottom before you act on anything. A lot of the losses that follow an incident like this come from the scams around it rather than the original problem.
   What happened
   Every Bitcoin wallet starts with a seed, and its security depends completely on that seed being unpredictable. If the randomness behind it is weak, everything built on top of it is weak too.
   In March 2021 Coldcard changed the code behind its seed generation. A check that was meant to guarantee the device’s hardware randomness was being used did not work as intended, and the firmware was instead built to use ordinary software randomness, calculated from predictable values like part of the chip’s fixed identifier and some timing registers. The hardware randomness was still there on the chip. That code path simply stopped using it.
   The result is that the range of seeds a Coldcard could produce was drastically narrower than it should have been. How much narrower depends on the model and firmware, and how hard the seeds are to recover varies with it, but Coinkite now describes affected seeds as having around 72 bits of protection instead of the expected 128. That is a serious reduction, and it is being actively exploited.
   The two accounts worth reading:
   Coinkite’s advisory, the manufacturer’s own, which is being updated as they learn more
   Block’s technical analysis, the most thorough public writeup so far
   Coinkite’s advisory currently covers Mk3 from firmware 4.0.1, Mk4 and Mk5 before 5.6.0, and Q before 1.5.0Q. Block additionally identifies affected Mk2 firmware. Check the advisory directly rather than relying on this summary, since the scope has already widened once.
   Two things worth understanding if you own one. What matters is the firmware that was running when the seed was created, not when you bought the device, and not which wallet holds it today. And updating your firmware does not fix an existing seed. Recovering from this means generating a new seed and moving your funds to it.
   Coinkite also has guidance on where dice rolls or a strong passphrase change the picture. Read it there rather than taking a rule of thumb from us.
   Why Passport-generated seeds are not affected
   Passport does not use the Coldcard code involved in this.
   Both Passport Core and Passport Prime generate seeds by combining multiple independent hardware sources, including our avalanche noise circuit, a physical component on the board built specifically to produce randomness.
   The published seed generation code on both devices uses those hardware sources. It does not fall back to a serial number, a device identifier, a timer or a clock.
   Checking rather than trusting
   You do not have to take the above on our word, and we would rather you did not.
   Our firmware is open source, so you can read the code that creates your seed yourself. Both devices also have a documented reproducible build process, so you can build a release from source and confirm it matches the binary we published. Passport Core’s is at REPRODUCIBILITY.md and Passport Prime’s is in the KeyOS repository.
   Independent security audits of both Passport Core and Passport Prime are published in full, along with our responses to them, at foundation.xyz/security.
   Please be careful of scammers
   This is the part we would most like you to take away.
   Scammers are always circling, but when something high profile happens they go into overdrive, because they know a lot of people are suddenly worried, confused and in a hurry. Assume anyone who contacts you out of the blue about your wallet is a scammer until proven otherwise.
   To be completely clear about how we operate:
   Foundation will never ask for your seed words, recovery phrase, private keys, passphrase or PIN. Not by email, not on the forum, not in a support ticket, not on a call. There is no situation in which we need them.
   We will never ask you to type your recovery phrase into a website, a form, an app or a support tool.
   We will never contact you unexpectedly about your wallet, and we will never ask you to move your funds.
   We will never ask you to share your screen or install remote access software.
   If someone is pressuring you to act quickly, telling you your funds are at risk and they can help, offering a “recovery service”, or asking you to verify your seed somewhere, stop and do nothing. That is the scam.
   Be especially wary of direct messages, of people claiming to be Foundation or Coinkite staff, and of search results and sponsored links for wallet software. Only download software from the official source, and take a moment to check the address you are typing.
   If you do need to move funds because of this, there is no prize for speed over care. Take your time, verify addresses on your device screen, and if anything feels off, ask here in public rather than in a private message.

   Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

3. Earliest copy held
   seen 1 Aug 2026, 00:46 UTC · Captured here 6,656 chars
   Extracted text as captured

   Foundation Community
   IMPORTANT - Passport is NOT affected by the Coldcard seed vulnerability
   General
   qna
   July 31, 2026, 9:08am
   1
   A serious flaw in Coldcard’s seed generation was disclosed on 30 July, and funds are being stolen as a result. Here is where Passport stands.
   Seeds generated by a Passport are not affected. Passport Prime and Passport Core both use different code, and neither has ever contained this flaw.
   One important qualification. If you imported a seed that was originally created on an affected Coldcard into your Passport, that seed is still affected. Moving a seed to a different device does not repair it, because the problem is in how the seed was created, not where it now lives. The same applies if an affected Coldcard key is one of the keys in a multisig setup. If that describes you, read Coinkite’s advisory below and treat it as urgent.
   If you own a Coldcard at all, go and read Coinkite’s advisory before anything else. It is time sensitive.
   And please read the section on scams at the bottom before you act on anything. A lot of the losses that follow an incident like this come from the scams around it rather than the original problem.
   What happened
   Every Bitcoin wallet starts with a seed, and its security depends completely on that seed being unpredictable. If the randomness behind it is weak, everything built on top of it is weak too.
   In March 2021 Coldcard changed the code behind its seed generation. A check that was meant to guarantee the device’s hardware randomness was being used did not work as intended, and the firmware was instead built to use ordinary software randomness, calculated from predictable values like part of the chip’s fixed identifier and some timing registers. The hardware randomness was still there on the chip. That code path simply stopped using it.
   The result is that the range of seeds a Coldcard could produce was drastically narrower than it should have been. How much narrower depends on the model and firmware, and how hard the seeds are to recover varies with it, but Coinkite now describes affected seeds as having around 72 bits of protection instead of the expected 128. That is a serious reduction, and it is being actively exploited.
   The two accounts worth reading:
   Coinkite’s advisory, the manufacturer’s own, which is being updated as they learn more
   Block’s technical analysis, the most thorough public writeup so far
   Coinkite’s advisory currently covers Mk3 from firmware 4.0.1, Mk4 and Mk5 before 5.6.0, and Q before 1.5.0Q. Block additionally identifies affected Mk2 firmware. Check the advisory directly rather than relying on this summary, since the scope has already widened once.
   Two things worth understanding if you own one. What matters is the firmware that was running when the seed was created, not when you bought the device, and not which wallet holds it today. And updating your firmware does not fix an existing seed. Recovering from this means generating a new seed and moving your funds to it.
   Coinkite also has guidance on where dice rolls or a strong passphrase change the picture. Read it there rather than taking a rule of thumb from us.
   Why Passport-generated seeds are not affected
   Passport does not use the Coldcard code involved in this.
   Both Passport Core and Passport Prime generate seeds by combining multiple independent hardware sources, including our avalanche noise circuit, a physical component on the board built specifically to produce randomness.
   The published seed generation code on both devices uses those hardware sources. It does not fall back to a serial number, a device identifier, a timer or a clock.
   Checking rather than trusting
   You do not have to take the above on our word, and we would rather you did not.
   Our firmware is open source, so you can read the code that creates your seed yourself. Both devices also have a documented reproducible build process, so you can build a release from source and confirm it matches the binary we published. Passport Core’s is at REPRODUCIBILITY.md and Passport Prime’s is in the KeyOS repository.
   Independent security audits of both Passport Core and Passport Prime are published in full, along with our responses to them, at foundation.xyz/security.
   Please be careful of scammers
   This is the part we would most like you to take away.
   Scammers are always circling, but when something high profile happens they go into overdrive, because they know a lot of people are suddenly worried, confused and in a hurry. Assume anyone who contacts you out of the blue about your wallet is a scammer until proven otherwise.
   To be completely clear about how we operate:
   Foundation will never ask for your seed words, recovery phrase, private keys, passphrase or PIN. Not by email, not on the forum, not in a support ticket, not on a call. There is no situation in which we need them.
   We will never ask you to type your recovery phrase into a website, a form, an app or a support tool.
   We will never contact you unexpectedly about your wallet, and we will never ask you to move your funds.
   We will never ask you to share your screen or install remote access software.
   If someone is pressuring you to act quickly, telling you your funds are at risk and they can help, offering a “recovery service”, or asking you to verify your seed somewhere, stop and do nothing. That is the scam.
   Be especially wary of direct messages, of people claiming to be Foundation or Coinkite staff, and of search results and sponsored links for wallet software. Only download software from the official source, and take a moment to check the address you are typing.
   If you do need to move funds because of this, there is no prize for speed over care. Take your time, verify addresses on your device screen, and if anything feels off, ask here in public rather than in a private message.

   Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.