Passport is not affected
passport-not-affected
- Organisation
- Foundation
- Evidence role
- Vendor statement
- Published
- 2026-07-31
- Source changes
- 1
- Detected differences
- 1
- Unreviewed
- 0
- Copies held
- 2
The statement adds that a COLDCARD-generated seed imported into a Passport remains at risk.
Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked 2 Aug 2026, 00:59 UTC.
Public privacy boundary
Snapshot and diff bodies for this chain monitor are held in the local evidence archive but withheld from the public site because they can contain victim addresses. Integrity hashes, capture times and reviewed change summaries remain available below.
-
Foundation added a reply to the thread saying manual firmware updates outside Envoy are scheduled for the next but one release, with no definitive timeframe committed.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 4 lines
qna: We plan to allow for manual firmware updates outside of Envoy yes. When? +qna +August 1, 2026, 10:24am +5 +This is currently scheduled for the next but one release, but our roadmap is always subject to change and as of right now, I do not have definitive time frame for this. Home Categories GuidelinesExtracted text as captured
Foundation Community IMPORTANT - Passport is NOT affected by the Coldcard seed vulnerability General qna July 31, 2026, 9:08am 1 A serious flaw in Coldcard’s seed generation was disclosed on 30 July, and funds are being stolen as a result. Here is where Passport stands. Seeds generated by a Passport are not affected. Passport Prime and Passport Core both use different code, and neither has ever contained this flaw. One important qualification. If you imported a seed that was originally created on an affected Coldcard into your Passport, that seed is still affected. Moving a seed to a different device does not repair it, because the problem is in how the seed was created, not where it now lives. The same applies if an affected Coldcard key is one of the keys in a multisig setup. If that describes you, read Coinkite’s advisory below and treat it as urgent. If you own a Coldcard at all, go and read Coinkite’s advisory before anything else. It is time sensitive. And please read the section on scams at the bottom before you act on anything. A lot of the losses that follow an incident like this come from the scams around it rather than the original problem. What happened Every Bitcoin wallet starts with a seed, and its security depends completely on that seed being unpredictable. If the randomness behind it is weak, everything built on top of it is weak too. In March 2021 Coldcard changed the code behind its seed generation. A check that was meant to guarantee the device’s hardware randomness was being used did not work as intended, and the firmware was instead built to use ordinary software randomness, calculated from predictable values like part of the chip’s fixed identifier and some timing registers. The hardware randomness was still there on the chip. That code path simply stopped using it. The result is that the range of seeds a Coldcard could produce was drastically narrower than it should have been. How much narrower depends on the model and firmware, and how hard the seeds are to recover varies with it, but Coinkite now describes affected seeds as having around 72 bits of protection instead of the expected 128. That is a serious reduction, and it is being actively exploited. The two accounts worth reading: Coinkite’s advisory, the manufacturer’s own, which is being updated as they learn more Block’s technical analysis, the most thorough public writeup so far Coinkite’s advisory currently covers Mk3 from firmware 4.0.1, Mk4 and Mk5 before 5.6.0, and Q before 1.5.0Q. Block additionally identifies affected Mk2 firmware. Check the advisory directly rather than relying on this summary, since the scope has already widened once. Two things worth understanding if you own one. What matters is the firmware that was running when the seed was created, not when you bought the device, and not which wallet holds it today. And updating your firmware does not fix an existing seed. Recovering from this means generating a new seed and moving your funds to it. Coinkite also has guidance on where dice rolls or a strong passphrase change the picture. Read it there rather than taking a rule of thumb from us. Why Passport-generated seeds are not affected Passport does not use the Coldcard code involved in this. Both Passport Core and Passport Prime generate seeds by combining multiple independent hardware sources, including our avalanche noise circuit, a physical component on the board built specifically to produce randomness. The published seed generation code on both devices uses those hardware sources. It does not fall back to a serial number, a device identifier, a timer or a clock. Checking rather than trusting You do not have to take the above on our word, and we would rather you did not. Our firmware is open source, so you can read the code that creates your seed yourself. Both devices also have a documented reproducible build process, so you can build a release from source and confirm it matches the binary we published. Passport Core’s is at REPRODUCIBILITY.md and Passport Prime’s is in the KeyOS repository. Independent security audits of both Passport Core and Passport Prime are published in full, along with our responses to them, at foundation.xyz/security. Please be careful of scammers This is the part we would most like you to take away. Scammers are always circling, but when something high profile happens they go into overdrive, because they know a lot of people are suddenly worried, confused and in a hurry. Assume anyone who contacts you out of the blue about your wallet is a scammer until proven otherwise. To be completely clear about how we operate: Foundation will never ask for your seed words, recovery phrase, private keys, passphrase or PIN. Not by email, not on the forum, not in a support ticket, not on a call. There is no situation in which we need them. We will never ask you to type your recovery phrase into a website, a form, an app or a support tool. We will never contact you unexpectedly about your wallet, and we will never ask you to move your funds. We will never ask you to share your screen or install remote access software. If someone is pressuring you to act quickly, telling you your funds are at risk and they can help, offering a “recovery service”, or asking you to verify your seed somewhere, stop and do nothing. That is the scam. Be especially wary of direct messages, of people claiming to be Foundation or Coinkite staff, and of search results and sponsored links for wallet software. Only download software from the official source, and take a moment to check the address you are typing. If you do need to move funds because of this, there is no prize for speed over care. Take your time, verify addresses on your device screen, and if anything feels off, ask here in public rather than in a private message.Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 0 lines
Extracted text as captured
Foundation Community IMPORTANT - Passport is NOT affected by the Coldcard seed vulnerability General qna July 31, 2026, 9:08am 1 A serious flaw in Coldcard’s seed generation was disclosed on 30 July, and funds are being stolen as a result. Here is where Passport stands. Seeds generated by a Passport are not affected. Passport Prime and Passport Core both use different code, and neither has ever contained this flaw. One important qualification. If you imported a seed that was originally created on an affected Coldcard into your Passport, that seed is still affected. Moving a seed to a different device does not repair it, because the problem is in how the seed was created, not where it now lives. The same applies if an affected Coldcard key is one of the keys in a multisig setup. If that describes you, read Coinkite’s advisory below and treat it as urgent. If you own a Coldcard at all, go and read Coinkite’s advisory before anything else. It is time sensitive. And please read the section on scams at the bottom before you act on anything. A lot of the losses that follow an incident like this come from the scams around it rather than the original problem. What happened Every Bitcoin wallet starts with a seed, and its security depends completely on that seed being unpredictable. If the randomness behind it is weak, everything built on top of it is weak too. In March 2021 Coldcard changed the code behind its seed generation. A check that was meant to guarantee the device’s hardware randomness was being used did not work as intended, and the firmware was instead built to use ordinary software randomness, calculated from predictable values like part of the chip’s fixed identifier and some timing registers. The hardware randomness was still there on the chip. That code path simply stopped using it. The result is that the range of seeds a Coldcard could produce was drastically narrower than it should have been. How much narrower depends on the model and firmware, and how hard the seeds are to recover varies with it, but Coinkite now describes affected seeds as having around 72 bits of protection instead of the expected 128. That is a serious reduction, and it is being actively exploited. The two accounts worth reading: Coinkite’s advisory, the manufacturer’s own, which is being updated as they learn more Block’s technical analysis, the most thorough public writeup so far Coinkite’s advisory currently covers Mk3 from firmware 4.0.1, Mk4 and Mk5 before 5.6.0, and Q before 1.5.0Q. Block additionally identifies affected Mk2 firmware. Check the advisory directly rather than relying on this summary, since the scope has already widened once. Two things worth understanding if you own one. What matters is the firmware that was running when the seed was created, not when you bought the device, and not which wallet holds it today. And updating your firmware does not fix an existing seed. Recovering from this means generating a new seed and moving your funds to it. Coinkite also has guidance on where dice rolls or a strong passphrase change the picture. Read it there rather than taking a rule of thumb from us. Why Passport-generated seeds are not affected Passport does not use the Coldcard code involved in this. Both Passport Core and Passport Prime generate seeds by combining multiple independent hardware sources, including our avalanche noise circuit, a physical component on the board built specifically to produce randomness. The published seed generation code on both devices uses those hardware sources. It does not fall back to a serial number, a device identifier, a timer or a clock. Checking rather than trusting You do not have to take the above on our word, and we would rather you did not. Our firmware is open source, so you can read the code that creates your seed yourself. Both devices also have a documented reproducible build process, so you can build a release from source and confirm it matches the binary we published. Passport Core’s is at REPRODUCIBILITY.md and Passport Prime’s is in the KeyOS repository. Independent security audits of both Passport Core and Passport Prime are published in full, along with our responses to them, at foundation.xyz/security. Please be careful of scammers This is the part we would most like you to take away. Scammers are always circling, but when something high profile happens they go into overdrive, because they know a lot of people are suddenly worried, confused and in a hurry. Assume anyone who contacts you out of the blue about your wallet is a scammer until proven otherwise. To be completely clear about how we operate: Foundation will never ask for your seed words, recovery phrase, private keys, passphrase or PIN. Not by email, not on the forum, not in a support ticket, not on a call. There is no situation in which we need them. We will never ask you to type your recovery phrase into a website, a form, an app or a support tool. We will never contact you unexpectedly about your wallet, and we will never ask you to move your funds. We will never ask you to share your screen or install remote access software. If someone is pressuring you to act quickly, telling you your funds are at risk and they can help, offering a “recovery service”, or asking you to verify your seed somewhere, stop and do nothing. That is the scam. Be especially wary of direct messages, of people claiming to be Foundation or Coinkite staff, and of search results and sponsored links for wallet software. Only download software from the official source, and take a moment to check the address you are typing. If you do need to move funds because of this, there is no prize for speed over care. Take your time, verify addresses on your device screen, and if anything feels off, ask here in public rather than in a private message.Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
How to check this yourself
Each copy above is identified by the SHA-256 of its extracted text, shown beside it, and the diffs are plain unified diffs. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.
Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.
How to check this yourself
The SHA-256 prefixes above identify each held copy without turning this page into a mirror of somebody else's post. Compare a quotation against the original. If the post has since been edited or deleted, ask and the held copy can be produced.