What the developer wrote
Authored by Peter D. Gray
updates mk3
What changed, and why it matters
This commit updates Coldcard's release notes to announce that a previously disclosed limited-entropy bug in seed generation now also affects Mk3 hardware, and that a new Mk3 firmware version 4.2.0 has been released as a hotfix. The earlier notes told Mk3 users to stop generating seeds and move funds; the revised notes say Mk3 users can safely generate seeds again after installing 4.2.0. Seeds created before this fix may have only about 40 bits of randomness, making them far weaker than intended and potentially guessable by attackers.
Users with seeds generated on affected Mk3 firmware should install firmware 4.2.0 or later and create new seeds, then move funds. Users of Mk4/Mk5/Q should already be on 5.6.0/1.5.0Q or later and regenerate seeds if they were created on vulnerable versions. Adding a BIP-39 passphrase can also mitigate risk if moving funds immediately is not possible. Review the linked Coinkite blog announcement for step-by-step guidance.
Security signals we found
Hotfix for limited entropy bug in seed generation
Mk3 seeds previously had only ~40 bits of entropy
Mk4/Mk5/Q seeds may have had as low as ~72 bits of entropy
Urgent user action recommended: regenerate seeds
New Mk3 firmware 4.2.0 released to address the issue
Evidence from the diff
The diff only changes two Markdown release-history files. It adds Mk3 firmware 4.2.0 to the July 31, 2026 hotfix line and updates guidance: instead of telling Mk3 users that no firmware update was planned, it now states that 4.2.0 corrects the entropy bug and allows new seed generation on old hardware. The underlying issue is that seed generation on affected firmware produced critically low entropy (~40 bits on Mk3, ~72 bits on Mk4/Mk5/Q), well below the 128-bit target. The actual code fix is not present in this diff; only the documentation/announcement is shown.
Changed components
Coldcard Mk3 seed generation firmware (versions prior to 4.2.0)Coldcard Mk4/Mk5/Q seed generation firmware (versions prior to 5.6.0/1.5.0Q)release documentation: releases/ChangeLog.mdrelease documentation: releases/History-Mk3.mdInspect captured patch +10 / −8
diff --git a/releases/ChangeLog.md b/releases/ChangeLog.md
index f0890fc..a6bee76 100644
--- a/releases/ChangeLog.md
+++ b/releases/ChangeLog.md
@@ -2,17 +2,15 @@
This lists the changes in the most recent firmware, for each hardware platform.
-## 2026-07-31 Hotfix Versions: 5.6.0 & 1.5.0Q
+## 2026-07-31 Hotfix Versions: 5.6.0 (Mk4, MK5) and 1.5.0Q (Q1) and 4.2.0 (Mk3)
**Urgent hotfix to correct a limited entropy bug**
-Please regenerate seeds only with this version of the firmware and any
+Please regenerate seeds only with this new version of the firmware and any
later updates from today onwards.
-**Mk3 users must regenerate any seeds** made on version 4.0.1 or
-later as their entropy is critically low at just ~40 bits. We are
-not planning to update Mk3 firmware at this time, so please use
-newer hardware or add a BIP-39 passphrase as a stopgap.
+**Mk3 users must regenerate any seeds** made on earlier versions
+as their entropy is critically low at just ~40 bits.
On **Mk4, Mk5 and Q entropy** may be as low as ~72 bits. This is
well below our target of 128 bits.
diff --git a/releases/History-Mk3.md b/releases/History-Mk3.md
index d4f0c0c..5bb0928 100644
--- a/releases/History-Mk3.md
+++ b/releases/History-Mk3.md
@@ -1,11 +1,15 @@
*See ChangeLog.md for more recent changes, these are historic versions*
-**July 30/2026: Do not generate seeds on Mk3 hardware. Move funds to new seeds or a BIP-39
-derived secret.**
+**July 2026: Do not generate seeds on Mk3 hardware without 4.2.0 fixed version.
+Move funds to new seeds or a BIP-39 derived secret.**
Follow the steps listed in
[our blog announcement](https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/)
+## 4.2.0 - July 31, 2026
+
+- Hotfix to correct entropy bug and allow new seed generation on old hardware.
+
## 4.1.9 - Jun 26, 2023
- Bugfix: QR codes could not be rendered in 4.1.8 release due to a regression.
Why this scored 85/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.