Coldcard Mk2, Mk3, Mk4, Mk5, and Q Firmware Security Vulnerability

stackernews-firmware-vulnerability-announcement

https://stacker.news/items/1536720

Organisation

Stacker News

Evidence role

Community discussion

Published

2026-07-31

Source changes

0

Detected differences

0

Unreviewed

0

Copies held

1

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked 9 Aug 2026, 23:17 UTC.

1. Earliest copy held Current
   seen 4 Aug 2026, 04:15 UTC · Captured here 7,153 chars
   Extracted text as captured

   {
     "data": {
       "item": {
         "comments": {
           "comments": [
             {
               "createdAt": "2026-07-31T13:55:11.648Z",
               "text": "Mk3 update is now available: https://blog.coinkite.com/entropy-technical-backgrounder/\n\n![](https://m.stacker.news/150335)\n\n[source](https://x.com/COLDCARDwallet/status/2083186689246208474)",
               "user": {
                 "name": "Scoresby"
               }
             },
             {
               "createdAt": "2026-07-31T07:51:07.346Z",
               "text": "[![darth-HW-TOLD-YOU.jpg](https://i.postimg.cc/Wb6frxhm/darth-HW-TOLD-YOU.jpg)](https://postimg.cc/KRjNhq74)\n\n*\"darth was right again\"  vibes*",
               "user": {
                 "name": "DarthCoin"
               }
             },
             {
               "createdAt": "2026-07-31T10:21:53.163Z",
               "text": "Zach Herbert, CEO of Foundation Devices (a ColdCard competitor) put this out a few hours ago, alleging that this problem has its roots in CC's attempt to avoid an open source license: \n\n> Regarding the Coldcard entropy bug – many folks are explaining *what* happened but I wanted to take a minute to explain *why it may* have happened.\n>  \n> It's a disastrous situation and our heart goes out to all the Bitcoiners affected.\n>  \n> Here's a timeline of events:\n>  \n> On July 28 2020: [@FoundationHQ](https://x.com/FoundationHQ) announced our first Passport hardware wallet and noted that we were building on Coldcard firmware which at the time was GPLv3 licensed (FOSS license).\n>  \n> On July 30 2020: NVK publicly said he regretted choosing GPL because Coldcard now had a “clone” and that they would change things in future updates. [https://x.com/nvk/status/1288860345864527874](https://x.com/nvk/status/1288860345864527874)\n>  \n> On November 18 2020: Coldcard added its MIT + Commons Clause license, prohibiting commercial products substantially derived from the software. [https://github.com/Coldcard/firmware/commit/b6b9191145d37fbb6d754597350653141596dd12](https://t.co/OtBGLdeFTH)\n>  \n> On January 8, 2021: Coldcard firmware 3.2.1 formally announced, “License changed from GPL to MIT+CC on files for which the GPL doesn’t apply.” CC is the \"Commons Clause\" license addendum which is \"source available\" instead of FOSS.\n>  \n> On March 1, 2021: The “First pass w/ libNgU” commit removed the GPL [@Trezor](https://x.com/Trezor)-derived crypto libraries and replaced them with libNgU. That same 120-file commit changed seed generation code. libNgU was licensed with a novel “Licensed for Bitcoin Only” license.\n>  \n> On March 17, 2021: Version 4.0.0 announced that all crypto and BIP39 code had been replaced and that the “last remaining GPL code” was removed. [https://blog.coinkite.com/version-4.0.0-released/](https://t.co/40xchCMOMx)\n[https://github.com/Coldcard/firmware/blob/b18723dddb6d751c39978e4364b56b2414f68b47/releases/ChangeLog.md#L12](https://t.co/UBdezpgvDC)\n>  \n> Our best understanding right now is that the entropy bug was collateral damage from this major overhaul of the codebase.\n>  \n> To be clear, this overhaul was not solely about licensing. Coldcard also cited technical goals including adopting Bitcoin Core’s libsecp256k1, faster AES and SHA implementations, and reproducible builds.\n>  \n> But the timeline establishes two things: \n> (1) Foundation’s launch was the obvious impetus for Coldcard’s licensing change, and \n> (2) removing the remaining GPL code was an explicit goal of the subsequent v4 rewrite.\n>  \n> We don't know by how much the licensing pressure affected the scope or timeline of the rewrite. All we can determine is that the entropy bug was introduced inside the same 120-file commit that removed the old GPL code dependencies.\n\nhttps://x.com/zherbert/status/2082993276324319713?s=20",
               "user": {
                 "name": "Scoresby"
               }
             },
             {
               "createdAt": "2026-07-31T10:51:10.807Z",
               "text": "This is pretty devastating for Bitcoin. I told my wife briefly about this, and it just sounds complicated. For all the \"yeah buts\" out there, go try to orange pill someone after telling them what happened with Cold Card's entropy. Bitcoin self custody is difficult enough without these sorts stories. Trying to get someone to do dice rolls to create a wallet is not the kind of intro to Bitcoin 101 that makes entry level accessible.",
               "user": {
                 "name": "Slestak_Jack"
               }
             },
             {
               "createdAt": "2026-07-31T13:26:14.785Z",
               "text": "So if you rolled dice your seed is safe?",
               "user": {
                 "name": "anon"
               }
             },

   Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.