Wizardsardine post-mortem and user guidance

 If instead only some of the keys are Coldcard, or you use Taproot the attack is different. The descriptor partially protects you.
 If you are at risk, when you try to spend, an attacker can try to replace your transaction and steal its inputs. This is done by “replacing” the transaction by increasing its fee, before it gets mined. The attacker will not be able to take UTXOs that are not part of that transaction.
 Currently (1st Aug 2026) it seems this attack is not yet being performed, or still rare. We expect it to be common in the next few days, and automatic/guaranteed in the next weeks or earlier.
-Once these attacks are common, DO NOT BROADCAST your transactions. Your only protection will be to use an “out of band” service such as Slipstream from Mara.
+Once these attacks are common, DO NOT BROADCAST your transactions. Your only protection will be to use an “out-of-band” service such as Slipstream from Mara.
 Assuming you never spent nor refreshed from the wallet since its creation:
-Use an “out of band” service such as Slipstream. You are not at risk before you transact, assuming you never shared your descriptor.
+Use an “out-of-band” service such as Slipstream. You are not at risk before you transact, assuming you never shared your descriptor.

Organisation

Wizardsardine

Evidence role

Independent primary analysis

Published

2026-08-01

Source changes

2

Detected differences

2

Unreviewed

0

Copies held

3

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked 15 Aug 2026, 14:23 UTC.

1. source content difference between 1 Aug 2026, 19:47 UTC and 3 Aug 2026, 22:43 UTC Current source content +9 -8

   Substantive edits across the postmortem: the Slipstream advice moved from "wait for a Slipstream tool we will provide soon" to recommending an out-of-band service now, a new note states the Mk3 UID portion used is only the die coordinates (not unique, likely within 16 bits), the USB session risk line was reworded to say plugging in does not steal the seed, the seed-phrase warning now says 12/24 words, and a new warning was added that BIP85 mnemonics imported into coinjoin software will be fully linked.

   seen 3 Aug 2026, 22:43 UTC · Captured here 42,822 chars
   What changed from the previous capture 17 lines

    If instead only some of the keys are Coldcard, or you use Taproot the attack is different. The descriptor partially protects you.
    If you are at risk, when you try to spend, an attacker can try to replace your transaction and steal its inputs. This is done by “replacing” the transaction by increasing its fee, before it gets mined. The attacker will not be able to take UTXOs that are not part of that transaction.
    Currently (1st Aug 2026) it seems this attack is not yet being performed, or still rare. We expect it to be common in the next few days, and automatic/guaranteed in the next weeks or earlier.
   -Once these attacks are common, DO NOT BROADCAST your transactions. Your only protection will be to use an “out of band” service such as Slipstream from Mara.
   +Once these attacks are common, DO NOT BROADCAST your transactions. Your only protection will be to use an “out-of-band” service such as Slipstream from Mara.
    Assuming you never spent nor refreshed from the wallet since its creation:
   -Use an “out of band” service such as Slipstream. You are not at risk before you transact, assuming you never shared your descriptor.
   +Use an “out-of-band” service such as Slipstream. You are not at risk before you transact, assuming you never shared your descriptor.
    The technical explanation
    A SegWit wallet publishes the Script on the first spend. Before you have ever spent, a SegWit Liana output shows only a hash on the blockchain, and an attacker working from the chain alone sees nothing to match. But the first time you spend, the transaction reveals the complete policy: the public keys of every participant at that address, together with every threshold and timelock in the wallet. If all of those keys are affected, an attacker can recover each one’s extended public key, rebuild your entire descriptor, and derive every address you will ever use, past and future. One spend, and a chain-only attacker owns the whole wallet for good. If only some of the keys are affected, that same spend still lays the wallet’s structure bare and exposes the affected keys, but your addresses at large stay out of reach, because reconstructing them would need the extended keys of the strong signers too.
    A Taproot wallet reveals far less, because it keeps each spending path in a separate branch and a spend touches only what it must. Spending through a multisig primary reveals the keys of that one path at that one address, never the rest of your wallet and never your other addresses, and because each address blends its own keys the values differ at every index, so there is no fixed target for an attacker’s table across your wallet. This compartmentalization is the real Taproot advantage: it contains the blast radius of a spend.
    Backup your new descriptor once it’s done.
    ⚠️ Before transfering your funds, assess the risks.
    If you transacted or refreshed in the past and use Segwit and only Coldcards in your setup, transfer normally, ASAP. Being too late will have your funds stolen, this is a race against the clock.
   -In any other case (if you NEVER EVER transacted nor refreshed from your wallet, or you use taproot, or you don’t only use Coldcards) the safest option is to wait for a Slipstream tool we will provide soon.
   -You can craft the transactions from your old wallet (another tab at the top of Liana), to addresses generated in the new one. DO NOT broadcast them if the best option for you is the Slipstream tool.
   +In any other case (if you NEVER EVER transacted nor refreshed from your wallet, or you use taproot, or you don’t only use Coldcards) the safest option is to use an out-of-band service, such as Slipstream.
   +You can craft the transactions from your old wallet (another tab at the top of Liana), to addresses generated in the new one. DO NOT broadcast them if the best option for you is the out-of-band tool.
    Of course, if your wallet does not fall under immediate risk, you can transfer normally.
    Section 2: What exactly happened
    A quick refresher on randomness
    pad = *(uint32_t *)MP_HAL_UNIQUE_ID_ADDRESS ^ SysTick->VAL;
    n = RTC->TR;
    d = RTC->SSR;
   -So: the chip’s unique identifier, combined with the boot counter, plus the time and sub-second value of the internal clock at the moment of generation. The chip ID was never designed to be a secret. It is readable, and above all it is structured, since it encodes lot and wafer numbers along with coordinates on the silicon wafer. This is not 96 bits of randomness, nowhere close.
   +So: Part of the chip’s unique identifier, combined with the boot counter, plus the time and sub-second value of the internal clock at the moment of generation. The chip ID was never designed to be a secret. It is readable, and above all it is structured, since it encodes lot and wafer numbers along with coordinates on the silicon wafer. This is not 96 bits of randomness, nowhere close.
   +The part of the UID being used is only the coordinates of the die on the silicon wafer. It is not unique, and likely fits well within a 16 bits space.
    On the Mk3, the search space therefore shrinks to a few dozen bits instead of 256. In practice, that means an attacker can enumerate every possible seed, compute the matching addresses, and check them against the blockchain to spot the ones holding funds. No access to your device is required.
    The advertised design, and the real code
    On paper, the Mk3’s randomness came from one source: the microcontroller’s TRNG, XORed with an internal PRNG and conditioned through SHA-256. That is a reasonable design, and it has one defining property. There is a single place the entropy can come from, so the whole thing rests on that one call actually happening.
    Run a recovery drill on your new wallet before sending it anything. Wipe the device, restore from your backup, and check that you land on the same addresses. That is the only way to know your backup actually works.
    When you make the transfer, verify the receiving address on the screen of the Coldcard doing the sending, and confirm beforehand that this address really belongs to your new device by displaying it on that device’s screen. Never trust an address shown only on a computer screen.
    Keep your old backup until the migration is complete and verified. The old seed is compromised, but it is still the only thing that controls the coins until they have actually moved.
   -Finally, watch out for scams, which will multiply in the coming days. Some people will exploit the panic to extract your seed phrase. Do not install software you found in a hurry, do not buy a device from an unknown seller, and never listen to anyone who reaches out to you unprompted in a DM to help. No legitimate support team will ever ask for your 24 words. Expect fake “recovery services” too, offering to get your stolen coins back for a fee. They cannot.
   +Finally, watch out for scams, which will multiply in the coming days. Some people will exploit the panic to extract your seed phrase. Do not install software you found in a hurry, do not buy a device from an unknown seller, and never listen to anyone who reaches out to you unprompted in a DM to help. No legitimate support team will ever ask for your 12/24 words. Expect fake “recovery services” too, offering to get your stolen coins back for a fee. They cannot.
    If you have already been robbed
    Coinkite has said they will work with affected users who want to file a police report, make an insurance claim or run their own investigation, and that they will provide a written incident summary specific to your loss along with whatever transaction data they can share. They have also said they are cooperating with on-chain investigators and with any law enforcement agency that opens a case.
    Record everything on your side before it gets lost: the transaction IDs of the theft, the affected addresses, your device model and firmware version, and roughly when and how the seed was originally created.
    This family is nastier, because it hits even the users who did things right, with a seed generated from dice or imported from another device. These features draw straight from the faulty generator, without going through your seed at all.
    Paper wallets are the most worrying case. The function that creates them asks for a key pair without supplying a seed, which makes it pull its bytes directly from the broken generator. The paper wallet’s private key is therefore literally the PRNG’s output. It bears no relation to your seed, and every paper wallet created on a Coldcard since 2021 has an enumerable private key, unless it was generated through the dice option. These keys stand alone, often printed and then given away or forgotten in a safe, and whoever holds them today may not even know where they came from.
    The clone-to-another-device function is broken too. The mechanism relies on an ephemeral key exchange between the two Coldcards, over the SD card, from which the transfer’s encryption key is derived. Since those ephemeral keys come from the faulty generator, anyone who gets hold of the clone file can recompute them, redo the exchange and decrypt everything, and so recover the seed in the clear. Even if that seed was generated with dice.
   -The encrypted USB session between the Coldcard and your computer relies on the same kind of ephemeral key. This one isn’t signifiant.
   +The encrypted USB session between the Coldcard and your computer relies on the same kind of ephemeral key. This does not mean plugging in your Coldcard steals the seed phrase.
    The C key of Coldcard’s co-signing feature, the 12 words the device keeps in order to enforce a spending policy, also comes from the broken generator.
    The password generator built into Secure Notes & Passwords is affected in two of its modes. The mode that produces words is built on the same function as seed generation. The mode meant for sites with strict requirements states its own entropy budget in a code comment, 49 bits, which was already tight before this problem was even taken into account. Here again, these passwords protect accounts that have nothing to do with Bitcoin.
    Both secret teleport mechanisms are affected. The password used to transfer a seed between two devices is 40 bits by design, and it is drawn from the broken generator. The exchange between multisig co-signers relies on a 28-bit derivation index, predictable as well.
    Privacy
    Any seed created on a Coldcard since 2021 has to be treated as public. And if the seed is public, so is the entire transaction history that flows from it, retroactively and permanently.
    The point that deserves the most attention is a second-order effect, one that hits people who have never owned a Coldcard. In a coinjoin round or a payjoin, your anonymity depends on the number of participants who are indistinguishable from one another. If some of them become identifiable, your own anonymity set shrinks accordingly. And that shrinkage is retroactive: it applies to every mix performed since 2021, and there is nothing you can do about it today.
   -Coldcard does not natively support any coinjoin implementation, but many users send their funds from their Coldcard to coinjoin software and then bring them back, and in that case anonymity drops for everyone.
   +Coldcard does not natively support any coinjoin implementation, but many users send their funds from their Coldcard to coinjoin software and then bring them back, and in that case anonymity drops for everyone. Worse, users who imported a BIP85 mnemonic derived from an affected Coldcard into their Coinjoin software will be fully linked.
    Two further effects are worth adding. Chain analysis firms gain a considerable set of addresses they can label once and for all. And your counterparties, the people who sent you funds or received funds from you, see part of their own transaction graph exposed by association.
    Section 6: How to stop being exposed to this kind of flaw
    Once your funds are safe, the real question becomes: how do you avoid going through this again with another brand in the future? There are not that many options.
   

   Extracted text as captured

   Wizardsardine
   Revault
   Liana
   About
   Blog
   Back to blog list
   Coldcard
   Security
   Self-Custody
   Multisig
   Published on Sat, Aug 1, 2026 by Kevin Loaec
   Critical Coldcard flaw: what happened, who is affected, and what to do
   Coldcard devices had an entropy bug since 2021, MK2, MK3, MK4, MK5 and Q wallets are being drained right now. Here is what happened in the code, exactly who is affected, what to do today, and how to build a setup that withstands this kind of flaw.
   How to read this VERY LONG blog post:
   the first section covers Liana users, and is interesting to read to multisig users too. They cover risks and actions to take.
   the rest of the article is the technical analysis of the bugs and risks surrounding the attack, incuding in-depth educational content.
   If you don’t care about Liana or Multisig and just want to learn everything we know about the attack, skip the first sections.
   This blog post was written by 3 people in parallel. Any first person “I, me, myself” is from Kevin Loaec, and may reflect personal preference and opinion not shared by the rest of the team.
   Additional images will be added over time, to add clarity
   ⚠️ Liana users: if you use Coldcard devices in your setup, such that Coldcard devices are sufficent to spend without other keys (for example, a 2-of-3 primary with 2 Coldcards, or even just a single sig Coldcard primay path), you need to move your funds to a new setup.
   ⚠️ Any Coldcard users: If you generated a seed on a Coldcard since 2021, including models MK2, MK3, MK4, MK5 and Q, you need to move your funds immediately. Wallets are being drained as you read this. Only wallets generated using 50+ fair dice rolls are safe but advanced features of the device are still broken. Wallets from before 2021 are safe.
   ⚠️ Even if you did not generate your seed on an affected Coldcard, multiple advanced features of the Coldcard devices are broken. Dice rolls do not protect you here.
   This article tries to cover as much of the scale of the unfolding situation as possible, including risks that are not yet exploited but imminent (a matter of hours).
   1000s of bitcoins have already been drained, and this is only the beginning.
   Fixed firmware is out, it DOES NOT save your existing seed and wallets. Coinkite shipped emergency hotfixes on 31 July: version 4.2.0 for the Mk3, 5.6.0 for the Mk4 and Mk5, and 1.5.0Q for the Q. The Edge channel, the experimental builds carrying the X and QX suffixes, has been fixed as well. These correct entropy generation for seeds created from now on. They do not repair a seed that was already generated by affected firmware. A firmware update on its own changes nothing for the coins you hold today.
   Section 1: Liana, Miniscript and Multisig - you are potentially at risk
   If none of your key was generated on a Coldcard, you are safe.
   If any of your key was generated on a Coldcard, or coming from a mnemonic initially generated on a Coldcard, you may be at risk.
   A Liana wallet spends through independent paths, the one thing that decides your risk is whether any single spending path can be satisfied with affected keys alone. A path falls the moment enough of its keys are weak to meet its threshold.
   A “primary path” is the non-timelocked spending condition of Liana.
   If your primary path can be met with affected Coldcard keys alone, move your funds while following the migration steps below. If only a recovery path can, move quickly but the timelock protects you.
   ⚠️ Before moving funds, read the WHAT DO I DO AS A LIANA USER? at the end of this section. It’s important.
   If you use the “Simple inheritance” setup
   One key you use day to day, and a second key usable only after a delay, meant as a fallback or for an heir. Each path is a single key, so there is no threshold to protect you: one affected key breaks that path.
   Where your affected Coldcard key sits
   Risk
   Action
   The primary key
   immediate risk
   Move ASAP, following the steps below

   Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

2. source content difference between 1 Aug 2026, 17:17 UTC and 1 Aug 2026, 19:47 UTC source content +5 -5

   Wizardsardine added explicit Section 3 and Section 4 labels to two previously unlabelled headings and renumbered the two that followed from 3 and 4 to 5 and 6. In the same edit the TAPSIGNER, OPENDIME and SATSCARD paragraph changed from a flat statement that they are not affected to Coinkite's claim plus the qualification that their proprietary code prevents the authors stating with certainty that the devices are safe, while noting the architecture is not a MicroPython stack.

   seen 1 Aug 2026, 19:47 UTC · Captured here 42,490 chars
   What changed from the previous capture 10 lines

    What does this mean for these models? Coinkite’s post-mortem puts the effective search space at about 40 bits on the Mk3 and about 72 bits on the Mk4, Mk5 and Q, both figures explicitly preliminary. To put that in perspective, 40 bits is swept in a matter of hours on ordinary hardware, and 72 bits is out of reach of a hobbyist but not of a funded attacker, while the design target was 128.
    Block’s engineering team reads the Mk4 case more harshly. Their analysis notes that the reseed does not accept the full digest, does not initialise a cryptographic DRBG, does not reseed MicroPython’s own fallback and does not reset the other Yasmarang state words. On their model, the secure-element contribution is capped at 2^32 possibilities, averaging roughly 2^31 trials.
    The 72-bit figure assumes an attacker who knows neither the chip ID nor the boot timing. An attacker who can pin those down, which is far from absurd for a targeted victim, is left with the 32-bit reseed alone, and 2^32 is trivially enumerable. So the honest statement is that the Mk4, Mk5 and Q sit somewhere between “expensive” and “cheap” depending on what the attacker already knows about your device, and nowhere near 128 bits in either case.
   -Who exactly is affected
   +Section 3: Who exactly is affected
    Here is where things stand, by model and by version:
    Model
    Firmware
    The Mk1 is not affected, and cannot be. Its last compatible firmware is 3.0.6, from December 2019, and installing anything newer bricks the device. The regression only arrived 15 months later, in 4.0.0. A Mk1 is therefore stuck on a version that still read the hardware TRNG directly.
    Version 4.0.0 was tagged on 17 March 2021 and already contains the regression, but it does not appear in the signed manifest, so it was never distributed. The first affected public release is therefore 4.0.1. The very first 5.0.0 tag from January 2022 did not yet contain the reseed, but it was never shipped either. The first Mk4 actually delivered, in March 2022, has always had it.
    Do not read the Mk4, Mk5 and Q as three separate cases. They all share the same firmware for the core logic, seed generation included, so what is true of one is true of the others.
   -TAPSIGNER, OPENDIME and SATSCARD are not affected, because they run on entirely different codebases.
   +For the TAPSIGNER, OPENDIME, and SATSCARD, Coinkite claims they are not affected, and it’s true that their architecture is completely different: they are not built on a MicroPython stack, whereas the bug specifically stems from a MicroPython compilation flag. However, since the code is proprietary, we cannot state with certainty that these devices are safe.
    Critically, installing a firmware fix will NOT secure your existing mnemonic. It will make new mnemonic generated on the device after installing the fix, secure.
    The special cases
    The firmware version alone does not tell you where you stand. Five things change everything.
    As an average user, consider your passphrase not secure. Even if your funds aren’t stolen yet, low entropy passphrases will be broken quickly, at scale.
    Finally, if your seed exists only as words on paper or steel, and you cannot say with certainty which device produced those words, you have to assume they could have come from an affected Coldcard. The same applies if you restored that backup onto some other wallet, of any brand. The device holding the seed today tells you nothing about where the number originally came from. This catches inherited seeds, wallets someone else set up for you, backups written years ago, and devices you have since sold or discarded, which you can no longer check.
    There is no way to settle it after the fact. 24 words drawn from 256 bits of physical noise and 24 words drawn from a counter look exactly alike, and no test you can run on the phrase itself will tell them apart. So doubt is not a middle position here. A seed whose origin you cannot establish should be treated as affected, and migrated like the rest.
   -What to do now
   +Section 4: What to do now
    THIS SECTION DOES NOT APPLY TO LIANA USERS, and is more complex for other multisig users. Refer to the Section 1 above for information on how to deal with the situation as a Liana user.
    Step 1: work out how urgent your case is
    You need to act right now, not tomorrow, if your seed was generated on a Mk2 or a Mk3 running firmware later than 3.2.2 without at least 50 private dice rolls. The same goes for a multisig whose spending threshold can be met with those keys alone, and for a seed born on one of those devices and later moved elsewhere.
    If you have already been robbed
    Coinkite has said they will work with affected users who want to file a police report, make an insurance claim or run their own investigation, and that they will provide a written incident summary specific to your loss along with whatever transaction data they can share. They have also said they are cooperating with on-chain investigators and with any law enforcement agency that opens a case.
    Record everything on your side before it gets lost: the transaction IDs of the theft, the affected addresses, your device model and firmware version, and roughly when and how the seed was originally created.
   -Section 3: The knock-on consequences
   +Section 5: The knock-on consequences
    The flaw is not limited to the outright theft of your bitcoins.
    What falls because the seed falls
    Everything derived from your master seed inherits its compromise automatically.
    The point that deserves the most attention is a second-order effect, one that hits people who have never owned a Coldcard. In a coinjoin round or a payjoin, your anonymity depends on the number of participants who are indistinguishable from one another. If some of them become identifiable, your own anonymity set shrinks accordingly. And that shrinkage is retroactive: it applies to every mix performed since 2021, and there is nothing you can do about it today.
    Coldcard does not natively support any coinjoin implementation, but many users send their funds from their Coldcard to coinjoin software and then bring them back, and in that case anonymity drops for everyone.
    Two further effects are worth adding. Chain analysis firms gain a considerable set of addresses they can label once and for all. And your counterparties, the people who sent you funds or received funds from you, see part of their own transaction graph exposed by association.
   -Section 4: How to stop being exposed to this kind of flaw
   +Section 6: How to stop being exposed to this kind of flaw
    Once your funds are safe, the real question becomes: how do you avoid going through this again with another brand in the future? There are not that many options.
    Add your own entropy
    The first is to supply part of the randomness yourself, typically with dice rolls. That is exactly what saved some Mk3 users, and the mixing option the Coldcard offers remains, in principle, a good idea: if the device’s generator is broken, your entropy makes up for it, and if your dice are loaded or you make a mistake, the device’s generator makes up for that.
   

   Extracted text as captured

   Wizardsardine
   Revault
   Liana
   About
   Blog
   Back to blog list
   Coldcard
   Security
   Self-Custody
   Multisig
   Published on Sat, Aug 1, 2026 by Kevin Loaec
   Critical Coldcard flaw: what happened, who is affected, and what to do
   Coldcard devices had an entropy bug since 2021, MK2, MK3, MK4, MK5 and Q wallets are being drained right now. Here is what happened in the code, exactly who is affected, what to do today, and how to build a setup that withstands this kind of flaw.
   How to read this VERY LONG blog post:
   the first section covers Liana users, and is interesting to read to multisig users too. They cover risks and actions to take.
   the rest of the article is the technical analysis of the bugs and risks surrounding the attack, incuding in-depth educational content.
   If you don’t care about Liana or Multisig and just want to learn everything we know about the attack, skip the first sections.
   This blog post was written by 3 people in parallel. Any first person “I, me, myself” is from Kevin Loaec, and may reflect personal preference and opinion not shared by the rest of the team.
   Additional images will be added over time, to add clarity
   ⚠️ Liana users: if you use Coldcard devices in your setup, such that Coldcard devices are sufficent to spend without other keys (for example, a 2-of-3 primary with 2 Coldcards, or even just a single sig Coldcard primay path), you need to move your funds to a new setup.
   ⚠️ Any Coldcard users: If you generated a seed on a Coldcard since 2021, including models MK2, MK3, MK4, MK5 and Q, you need to move your funds immediately. Wallets are being drained as you read this. Only wallets generated using 50+ fair dice rolls are safe but advanced features of the device are still broken. Wallets from before 2021 are safe.
   ⚠️ Even if you did not generate your seed on an affected Coldcard, multiple advanced features of the Coldcard devices are broken. Dice rolls do not protect you here.
   This article tries to cover as much of the scale of the unfolding situation as possible, including risks that are not yet exploited but imminent (a matter of hours).
   1000s of bitcoins have already been drained, and this is only the beginning.
   Fixed firmware is out, it DOES NOT save your existing seed and wallets. Coinkite shipped emergency hotfixes on 31 July: version 4.2.0 for the Mk3, 5.6.0 for the Mk4 and Mk5, and 1.5.0Q for the Q. The Edge channel, the experimental builds carrying the X and QX suffixes, has been fixed as well. These correct entropy generation for seeds created from now on. They do not repair a seed that was already generated by affected firmware. A firmware update on its own changes nothing for the coins you hold today.
   Section 1: Liana, Miniscript and Multisig - you are potentially at risk
   If none of your key was generated on a Coldcard, you are safe.
   If any of your key was generated on a Coldcard, or coming from a mnemonic initially generated on a Coldcard, you may be at risk.
   A Liana wallet spends through independent paths, the one thing that decides your risk is whether any single spending path can be satisfied with affected keys alone. A path falls the moment enough of its keys are weak to meet its threshold.
   A “primary path” is the non-timelocked spending condition of Liana.
   If your primary path can be met with affected Coldcard keys alone, move your funds while following the migration steps below. If only a recovery path can, move quickly but the timelock protects you.
   ⚠️ Before moving funds, read the WHAT DO I DO AS A LIANA USER? at the end of this section. It’s important.
   If you use the “Simple inheritance” setup
   One key you use day to day, and a second key usable only after a delay, meant as a fallback or for an heir. Each path is a single key, so there is no threshold to protect you: one affected key breaks that path.
   Where your affected Coldcard key sits
   Risk
   Action
   The primary key
   immediate risk
   Move ASAP, following the steps below

   Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

3. Earliest copy held
   seen 1 Aug 2026, 17:17 UTC · Captured here 42,209 chars
   Extracted text as captured

   Wizardsardine
   Revault
   Liana
   About
   Blog
   Back to blog list
   Coldcard
   Security
   Self-Custody
   Multisig
   Published on Sat, Aug 1, 2026 by Kevin Loaec
   Critical Coldcard flaw: what happened, who is affected, and what to do
   Coldcard devices had an entropy bug since 2021, MK2, MK3, MK4, MK5 and Q wallets are being drained right now. Here is what happened in the code, exactly who is affected, what to do today, and how to build a setup that withstands this kind of flaw.
   How to read this VERY LONG blog post:
   the first section covers Liana users, and is interesting to read to multisig users too. They cover risks and actions to take.
   the rest of the article is the technical analysis of the bugs and risks surrounding the attack, incuding in-depth educational content.
   If you don’t care about Liana or Multisig and just want to learn everything we know about the attack, skip the first sections.
   This blog post was written by 3 people in parallel. Any first person “I, me, myself” is from Kevin Loaec, and may reflect personal preference and opinion not shared by the rest of the team.
   Additional images will be added over time, to add clarity
   ⚠️ Liana users: if you use Coldcard devices in your setup, such that Coldcard devices are sufficent to spend without other keys (for example, a 2-of-3 primary with 2 Coldcards, or even just a single sig Coldcard primay path), you need to move your funds to a new setup.
   ⚠️ Any Coldcard users: If you generated a seed on a Coldcard since 2021, including models MK2, MK3, MK4, MK5 and Q, you need to move your funds immediately. Wallets are being drained as you read this. Only wallets generated using 50+ fair dice rolls are safe but advanced features of the device are still broken. Wallets from before 2021 are safe.
   ⚠️ Even if you did not generate your seed on an affected Coldcard, multiple advanced features of the Coldcard devices are broken. Dice rolls do not protect you here.
   This article tries to cover as much of the scale of the unfolding situation as possible, including risks that are not yet exploited but imminent (a matter of hours).
   1000s of bitcoins have already been drained, and this is only the beginning.
   Fixed firmware is out, it DOES NOT save your existing seed and wallets. Coinkite shipped emergency hotfixes on 31 July: version 4.2.0 for the Mk3, 5.6.0 for the Mk4 and Mk5, and 1.5.0Q for the Q. The Edge channel, the experimental builds carrying the X and QX suffixes, has been fixed as well. These correct entropy generation for seeds created from now on. They do not repair a seed that was already generated by affected firmware. A firmware update on its own changes nothing for the coins you hold today.
   Section 1: Liana, Miniscript and Multisig - you are potentially at risk
   If none of your key was generated on a Coldcard, you are safe.
   If any of your key was generated on a Coldcard, or coming from a mnemonic initially generated on a Coldcard, you may be at risk.
   A Liana wallet spends through independent paths, the one thing that decides your risk is whether any single spending path can be satisfied with affected keys alone. A path falls the moment enough of its keys are weak to meet its threshold.
   A “primary path” is the non-timelocked spending condition of Liana.
   If your primary path can be met with affected Coldcard keys alone, move your funds while following the migration steps below. If only a recovery path can, move quickly but the timelock protects you.
   ⚠️ Before moving funds, read the WHAT DO I DO AS A LIANA USER? at the end of this section. It’s important.
   If you use the “Simple inheritance” setup
   One key you use day to day, and a second key usable only after a delay, meant as a fallback or for an heir. Each path is a single key, so there is no threshold to protect you: one affected key breaks that path.
   Where your affected Coldcard key sits
   Risk
   Action
   The primary key
   immediate risk
   Move ASAP, following the steps below

   Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.