Wizardsardine post-mortem and user guidance
wizardsardine-postmortem
- Organisation
- Wizardsardine
- Evidence role
- Independent primary analysis
- Published
- 2026-08-01
- Source changes
- 1
- Detected differences
- 1
- Unreviewed
- 0
- Copies held
- 2
Long-form post-mortem by the Liana wallet vendor: section 1 addresses Liana users and descriptor game theory, the rest reconstructs the flaw and argues that imported and dice-generated seeds remain exposed through derived-material features. Wizardsardine sells competing wallet software, and the post was self-described as written quickly under stress with corrections invited; its feature-exposure claims are the author's analysis until checked against source.
Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked 2 Aug 2026, 01:00 UTC.
Public privacy boundary
Snapshot and diff bodies for this chain monitor are held in the local evidence archive but withheld from the public site because they can contain victim addresses. Integrity hashes, capture times and reviewed change summaries remain available below.
-
Wizardsardine added explicit Section 3 and Section 4 labels to two previously unlabelled headings and renumbered the two that followed from 3 and 4 to 5 and 6. In the same edit the TAPSIGNER, OPENDIME and SATSCARD paragraph changed from a flat statement that they are not affected to Coinkite's claim plus the qualification that their proprietary code prevents the authors stating with certainty that the devices are safe, while noting the architecture is not a MicroPython stack.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 10 lines
What does this mean for these models? Coinkite’s post-mortem puts the effective search space at about 40 bits on the Mk3 and about 72 bits on the Mk4, Mk5 and Q, both figures explicitly preliminary. To put that in perspective, 40 bits is swept in a matter of hours on ordinary hardware, and 72 bits is out of reach of a hobbyist but not of a funded attacker, while the design target was 128. Block’s engineering team reads the Mk4 case more harshly. Their analysis notes that the reseed does not accept the full digest, does not initialise a cryptographic DRBG, does not reseed MicroPython’s own fallback and does not reset the other Yasmarang state words. On their model, the secure-element contribution is capped at 2^32 possibilities, averaging roughly 2^31 trials. The 72-bit figure assumes an attacker who knows neither the chip ID nor the boot timing. An attacker who can pin those down, which is far from absurd for a targeted victim, is left with the 32-bit reseed alone, and 2^32 is trivially enumerable. So the honest statement is that the Mk4, Mk5 and Q sit somewhere between “expensive” and “cheap” depending on what the attacker already knows about your device, and nowhere near 128 bits in either case. -Who exactly is affected +Section 3: Who exactly is affected Here is where things stand, by model and by version: Model Firmware The Mk1 is not affected, and cannot be. Its last compatible firmware is 3.0.6, from December 2019, and installing anything newer bricks the device. The regression only arrived 15 months later, in 4.0.0. A Mk1 is therefore stuck on a version that still read the hardware TRNG directly. Version 4.0.0 was tagged on 17 March 2021 and already contains the regression, but it does not appear in the signed manifest, so it was never distributed. The first affected public release is therefore 4.0.1. The very first 5.0.0 tag from January 2022 did not yet contain the reseed, but it was never shipped either. The first Mk4 actually delivered, in March 2022, has always had it. Do not read the Mk4, Mk5 and Q as three separate cases. They all share the same firmware for the core logic, seed generation included, so what is true of one is true of the others. -TAPSIGNER, OPENDIME and SATSCARD are not affected, because they run on entirely different codebases. +For the TAPSIGNER, OPENDIME, and SATSCARD, Coinkite claims they are not affected, and it’s true that their architecture is completely different: they are not built on a MicroPython stack, whereas the bug specifically stems from a MicroPython compilation flag. However, since the code is proprietary, we cannot state with certainty that these devices are safe. Critically, installing a firmware fix will NOT secure your existing mnemonic. It will make new mnemonic generated on the device after installing the fix, secure. The special cases The firmware version alone does not tell you where you stand. Five things change everything. As an average user, consider your passphrase not secure. Even if your funds aren’t stolen yet, low entropy passphrases will be broken quickly, at scale. Finally, if your seed exists only as words on paper or steel, and you cannot say with certainty which device produced those words, you have to assume they could have come from an affected Coldcard. The same applies if you restored that backup onto some other wallet, of any brand. The device holding the seed today tells you nothing about where the number originally came from. This catches inherited seeds, wallets someone else set up for you, backups written years ago, and devices you have since sold or discarded, which you can no longer check. There is no way to settle it after the fact. 24 words drawn from 256 bits of physical noise and 24 words drawn from a counter look exactly alike, and no test you can run on the phrase itself will tell them apart. So doubt is not a middle position here. A seed whose origin you cannot establish should be treated as affected, and migrated like the rest. -What to do now +Section 4: What to do now THIS SECTION DOES NOT APPLY TO LIANA USERS, and is more complex for other multisig users. Refer to the Section 1 above for information on how to deal with the situation as a Liana user. Step 1: work out how urgent your case is You need to act right now, not tomorrow, if your seed was generated on a Mk2 or a Mk3 running firmware later than 3.2.2 without at least 50 private dice rolls. The same goes for a multisig whose spending threshold can be met with those keys alone, and for a seed born on one of those devices and later moved elsewhere. If you have already been robbed Coinkite has said they will work with affected users who want to file a police report, make an insurance claim or run their own investigation, and that they will provide a written incident summary specific to your loss along with whatever transaction data they can share. They have also said they are cooperating with on-chain investigators and with any law enforcement agency that opens a case. Record everything on your side before it gets lost: the transaction IDs of the theft, the affected addresses, your device model and firmware version, and roughly when and how the seed was originally created. -Section 3: The knock-on consequences +Section 5: The knock-on consequences The flaw is not limited to the outright theft of your bitcoins. What falls because the seed falls Everything derived from your master seed inherits its compromise automatically. The point that deserves the most attention is a second-order effect, one that hits people who have never owned a Coldcard. In a coinjoin round or a payjoin, your anonymity depends on the number of participants who are indistinguishable from one another. If some of them become identifiable, your own anonymity set shrinks accordingly. And that shrinkage is retroactive: it applies to every mix performed since 2021, and there is nothing you can do about it today. Coldcard does not natively support any coinjoin implementation, but many users send their funds from their Coldcard to coinjoin software and then bring them back, and in that case anonymity drops for everyone. Two further effects are worth adding. Chain analysis firms gain a considerable set of addresses they can label once and for all. And your counterparties, the people who sent you funds or received funds from you, see part of their own transaction graph exposed by association. -Section 4: How to stop being exposed to this kind of flaw +Section 6: How to stop being exposed to this kind of flaw Once your funds are safe, the real question becomes: how do you avoid going through this again with another brand in the future? There are not that many options. Add your own entropy The first is to supply part of the randomness yourself, typically with dice rolls. That is exactly what saved some Mk3 users, and the mixing option the Coldcard offers remains, in principle, a good idea: if the device’s generator is broken, your entropy makes up for it, and if your dice are loaded or you make a mistake, the device’s generator makes up for that.Extracted text as captured
Wizardsardine Revault Liana About Blog Back to blog list Coldcard Security Self-Custody Multisig Published on Sat, Aug 1, 2026 by Kevin Loaec Critical Coldcard flaw: what happened, who is affected, and what to do Coldcard devices had an entropy bug since 2021, MK2, MK3, MK4, MK5 and Q wallets are being drained right now. Here is what happened in the code, exactly who is affected, what to do today, and how to build a setup that withstands this kind of flaw. How to read this VERY LONG blog post: the first section covers Liana users, and is interesting to read to multisig users too. They cover risks and actions to take. the rest of the article is the technical analysis of the bugs and risks surrounding the attack, incuding in-depth educational content. If you don’t care about Liana or Multisig and just want to learn everything we know about the attack, skip the first sections. This blog post was written by 3 people in parallel. Any first person “I, me, myself” is from Kevin Loaec, and may reflect personal preference and opinion not shared by the rest of the team. Additional images will be added over time, to add clarity ⚠️ Liana users: if you use Coldcard devices in your setup, such that Coldcard devices are sufficent to spend without other keys (for example, a 2-of-3 primary with 2 Coldcards, or even just a single sig Coldcard primay path), you need to move your funds to a new setup. ⚠️ Any Coldcard users: If you generated a seed on a Coldcard since 2021, including models MK2, MK3, MK4, MK5 and Q, you need to move your funds immediately. Wallets are being drained as you read this. Only wallets generated using 50+ fair dice rolls are safe but advanced features of the device are still broken. Wallets from before 2021 are safe. ⚠️ Even if you did not generate your seed on an affected Coldcard, multiple advanced features of the Coldcard devices are broken. Dice rolls do not protect you here. This article tries to cover as much of the scale of the unfolding situation as possible, including risks that are not yet exploited but imminent (a matter of hours). 1000s of bitcoins have already been drained, and this is only the beginning. Fixed firmware is out, it DOES NOT save your existing seed and wallets. Coinkite shipped emergency hotfixes on 31 July: version 4.2.0 for the Mk3, 5.6.0 for the Mk4 and Mk5, and 1.5.0Q for the Q. The Edge channel, the experimental builds carrying the X and QX suffixes, has been fixed as well. These correct entropy generation for seeds created from now on. They do not repair a seed that was already generated by affected firmware. A firmware update on its own changes nothing for the coins you hold today. Section 1: Liana, Miniscript and Multisig - you are potentially at risk If none of your key was generated on a Coldcard, you are safe. If any of your key was generated on a Coldcard, or coming from a mnemonic initially generated on a Coldcard, you may be at risk. A Liana wallet spends through independent paths, the one thing that decides your risk is whether any single spending path can be satisfied with affected keys alone. A path falls the moment enough of its keys are weak to meet its threshold. A “primary path” is the non-timelocked spending condition of Liana. If your primary path can be met with affected Coldcard keys alone, move your funds while following the migration steps below. If only a recovery path can, move quickly but the timelock protects you. ⚠️ Before moving funds, read the WHAT DO I DO AS A LIANA USER? at the end of this section. It’s important. If you use the “Simple inheritance” setup One key you use day to day, and a second key usable only after a delay, meant as a fallback or for an heir. Each path is a single key, so there is no threshold to protect you: one affected key breaks that path. Where your affected Coldcard key sits Risk Action The primary key immediate risk Move ASAP, following the steps belowExcerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 0 lines
Extracted text as captured
Wizardsardine Revault Liana About Blog Back to blog list Coldcard Security Self-Custody Multisig Published on Sat, Aug 1, 2026 by Kevin Loaec Critical Coldcard flaw: what happened, who is affected, and what to do Coldcard devices had an entropy bug since 2021, MK2, MK3, MK4, MK5 and Q wallets are being drained right now. Here is what happened in the code, exactly who is affected, what to do today, and how to build a setup that withstands this kind of flaw. How to read this VERY LONG blog post: the first section covers Liana users, and is interesting to read to multisig users too. They cover risks and actions to take. the rest of the article is the technical analysis of the bugs and risks surrounding the attack, incuding in-depth educational content. If you don’t care about Liana or Multisig and just want to learn everything we know about the attack, skip the first sections. This blog post was written by 3 people in parallel. Any first person “I, me, myself” is from Kevin Loaec, and may reflect personal preference and opinion not shared by the rest of the team. Additional images will be added over time, to add clarity ⚠️ Liana users: if you use Coldcard devices in your setup, such that Coldcard devices are sufficent to spend without other keys (for example, a 2-of-3 primary with 2 Coldcards, or even just a single sig Coldcard primay path), you need to move your funds to a new setup. ⚠️ Any Coldcard users: If you generated a seed on a Coldcard since 2021, including models MK2, MK3, MK4, MK5 and Q, you need to move your funds immediately. Wallets are being drained as you read this. Only wallets generated using 50+ fair dice rolls are safe but advanced features of the device are still broken. Wallets from before 2021 are safe. ⚠️ Even if you did not generate your seed on an affected Coldcard, multiple advanced features of the Coldcard devices are broken. Dice rolls do not protect you here. This article tries to cover as much of the scale of the unfolding situation as possible, including risks that are not yet exploited but imminent (a matter of hours). 1000s of bitcoins have already been drained, and this is only the beginning. Fixed firmware is out, it DOES NOT save your existing seed and wallets. Coinkite shipped emergency hotfixes on 31 July: version 4.2.0 for the Mk3, 5.6.0 for the Mk4 and Mk5, and 1.5.0Q for the Q. The Edge channel, the experimental builds carrying the X and QX suffixes, has been fixed as well. These correct entropy generation for seeds created from now on. They do not repair a seed that was already generated by affected firmware. A firmware update on its own changes nothing for the coins you hold today. Section 1: Liana, Miniscript and Multisig - you are potentially at risk If none of your key was generated on a Coldcard, you are safe. If any of your key was generated on a Coldcard, or coming from a mnemonic initially generated on a Coldcard, you may be at risk. A Liana wallet spends through independent paths, the one thing that decides your risk is whether any single spending path can be satisfied with affected keys alone. A path falls the moment enough of its keys are weak to meet its threshold. A “primary path” is the non-timelocked spending condition of Liana. If your primary path can be met with affected Coldcard keys alone, move your funds while following the migration steps below. If only a recovery path can, move quickly but the timelock protects you. ⚠️ Before moving funds, read the WHAT DO I DO AS A LIANA USER? at the end of this section. It’s important. If you use the “Simple inheritance” setup One key you use day to day, and a second key usable only after a delay, meant as a fallback or for an heir. Each path is a single key, so there is no threshold to protect you: one affected key breaks that path. Where your affected Coldcard key sits Risk Action The primary key immediate risk Move ASAP, following the steps belowExcerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
How to check this yourself
Each copy above is identified by the SHA-256 of its extracted text, shown beside it, and the diffs are plain unified diffs. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.
Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.
How to check this yourself
The SHA-256 prefixes above identify each held copy without turning this page into a mirror of somebody else's post. Compare a quotation against the original. If the post has since been edited or deleted, ask and the held copy can be produced.