Public commit record
0/100 · Opaque
What the developer wrote
Authored by Peter D. Gray
packaging
! Very short subject! Too few words to establish purpose! No meaningful explanatory body
What changed, and why it matters
This commit is a changelog-only update that publicly discloses a severe, long-running security flaw in COLDCARD hardware wallets: for roughly five years, the devices generated cryptographic seeds with far less randomness than intended. On older Mk3 devices, seed entropy may have been as low as about 40 bits, and on Mk4/Mk5/Q devices as low as about 72 bits. That makes generated private keys much easier for an attacker to guess or reproduce, putting any funds secured by those keys at risk. The changelog also lists many other security fixes, including protections against a compromised USB host altering transactions before signing, restrictions on reading sensitive staged data over USB, and hardening of the random-number generator. Users are advised to upgrade immediately and regenerate any seeds created with affected firmware.
Recommended action
Upgrade to the fixed firmware versions (5.6.0+ for Mk4/Mk5, 1.5.0Q+ for Q1, 4.2.0+ for Mk3, 6.6.0+ for Edge Mk/Q) and regenerate all seeds, temporary seeds, and CCC keys created with affected firmware. Move funds from old addresses to newly generated addresses immediately. Review the vendor blog posts for detailed migration guidance and verify firmware signatures before installing.
Security signals we found
01
Vendor-disclosed critical entropy weakness affecting seed generation across multiple hardware platforms
02
Advisory states generated secrets may have only ~40 bits (Mk3) or ~72 bits (Mk4/Mk5/Q) of entropy, well below 128-bit target
03
Mandatory user-supplied entropy added for new master seeds, temporary seeds, and CCC key C
04
PRNG replaced with NIST SP 800-90A SHA-256 Hash_DRBG
05
Secure-element entropy now sampled directly per seed and boot seeding expanded from 32 to 256 bits
06
Multiple additional security bugfixes disclosed: USB dwld arbitrary PSRAM readback, PSBT rewrite before signing, callgate buffer validation, RNG fault detection, SIGHASH_SINGLE restrictions, Delta mode leaks, multisig duplicate/self-key rejection, firmware length/timestamp checks, Base58/SegWit parsing hardening
07
External researchers credited for several findings
Evidence from the diff
The commit updates releases/ChangeLog.md and releases/Next-ChangeLog.md. It adds a ‘July 2026 Security Advisory’ stating that firmware versions from 2021 through July 2026 contained a bug producing poor entropy during master seed generation. Affected safe versions are listed as 5.6.0+ (Mk4/Mk5), 1.5.0Q+ (Q1), 4.2.0+ (Mk3), and 6.6.0+ (Edge Mk/Q). The changelog describes a complete overhaul of entropy collection: direct sampling of STM32 TRNG plus both secure elements (SE1, SE2) per seed, 256-bit secure-element digest seeding at boot, replacement of the Yasmarang PRNG with a NIST SP 800-90A SHA-256 Hash_DRBG, and mandatory user-supplied entropy (dice, coin flips, or key mashing) for new seeds. Additional fixes cover RNG fault handling, USB dwld information disclosure, PSBT substitution by a hostile host, callgate integer overflow, firmware parsing, multisig enrollment, Delta mode leaks, and more. The Next-ChangeLog.md is reset to ‘tbd’ placeholders, indicating these items were promoted to the published changelog.
Changed components
COLDCARD firmware entropy generation subsystemMaster seed generationTemporary seed generationCCC key C generationlibngu random number generatorSTM32 TRNG and secure element (SE1/SE2) integrationUSB dwld/download interfacePSBT staging and signing workflowBootloader callgate / firmware update parsingDelta Mode PIN workflowMultisig wallet enrollmentBackup password / encryption salt / 2FA secret generationBIP-322 / BIP-85 / Seed Vault / Key Teleport workflowsInspect captured patch +134 / −118
### releases/ChangeLog.md
@@ -1,23 +1,141 @@
+## July 2026 Security Advisory
+
+- Versions from 2021 to July 2026 had a bug which produced poor entropy.
+- Any secrets generated on a COLDCARD in that period should be regenerated and
+ funds moved on chain **immediately**.
+- Master seeds can only be trusted from releases **after** these levels:
+ - 5.6.0 (Mk4, MK5)
+ - 1.5.0Q (Q1)
+ - 4.2.0 (Mk3)
+ - 6.6.0 (Edge Mk/Q)
+- [Blog post and updates](https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/)
+- [Technical background on the bug](https://blog.coinkite.com/entropy-technical-backgrounder/)
+
# Change Log
This lists the changes in the most recent firmware, for each hardware platform.
-## 2026-07-31 Hotfix Versions: 5.6.0 (Mk4, MK5) and 1.5.0Q (Q1) and 4.2.0 (Mk3)
+# Shared Improvements - Both Mk and Q
+
+- Improvements to Entropy Generation:
+ - Master seed generation now combines fresh entropy from the STM32 TRNG,
+ SE1, and SE2. Previously, SE1 and SE2 contributed through boot-time RNG
+ seeding; they are now also sampled directly for each new master seed.
+ - On every boot, RNG is seeded with the full 256-bit digest of entropy
+ from both Secure Elements (previously truncated to 32 bits).
+ - libngu now uses a `SHA-256 Hash_DRBG` (NIST SP 800-90A) instead of the Yasmarang PRNG.
+ - Backup passwords, encryption salt/IV, and 2FA secrets now use libngu's
+ Hash-DRBG-based RNG instead of calling the raw TRNG interface directly.
+ Remaining direct application uses of the raw TRNG are for non-secret values.
+ - RNG self-test proves `rng_get()` enters the hardware read path and stops
+ the boot if the check fails.
+ - Build-time checks verify that libngu's random-byte path reaches the
+ hardware `rng_get()` implementation.
+- Newly generated master seeds, Temporary Seeds, and CCC key C now **require**
+ extra user-supplied entropy (dice, coin flips, or keyboard mashing):
+ - Choose key mashing (based on
+ [Peter Todd's Push-Button RNG](https://petertodd.org/2014/push-button-rng)),
+ physical dice rolls or physical coin flips.
+ - Entropy supplied by the user is added to randomness from the STM32 TRNG,
+ SE1, and SE2. It does not replace those sources.
+ - Dice and coin results are checked for obviously bad distributions.
+ - Key mashing hashes raw GPIO press timing captured at CPU-cycle
+ resolution (~8.33 ns at 120 MHz) before keypad debounce. Releases are ignored,
+ repeating one key is valid, and at least 65 presses are required. The first
+ press establishes the timing reference; each of the following 64 inter-press
+ gaps is conservatively credited with two bits of entropy. The full timing
+ delta and key identity are mixed in, but key identity receives no entropy credit.
+ Users may continue mashing beyond 65 presses to contribute additional timing entropy.
+- Dice-Only Enhancements:
+ - Dice-only seed generation now clearly warns: **NO hardware entropy is
+ included.** The final hash shown on screen must be kept secret.
+ - Temporary dice-only seeds now use the same warning and mandatory
+ entropy checks as master dice-only seeds.
+ - Held digit keys count as one dice roll, and completion keys now match
+ each COLDCARD model.
+- Delta Mode hardening:
+ - Wipe seed in Delta Mode when saved BIP-39 passphrases are listed, instead of revealing them.
+ - Block access to Seed Vault entries through Key Teleport's secret picker,
+ CCC key-C import, and Seed XOR restore in Delta Mode. Thanks to "Rety"
+ for reporting the Seed XOR issue.
+ - Wipe seed before BIP-85 derivation in Delta Mode.
+ - Prevent valid message signatures when using a Delta Mode PIN.
+- Bugfix: Detect `RNG_SR_SEIS` and `RNG_SR_SECS`, retry safely, and fail closed on persistent faults.
+- Bugfix: BIP-322 message signing now rejects non-ASCII and other unsupported
+ message text before approval. Thanks to [@KirillCherikov](https://github.com/KirillCherikov) for reporting.
+- Bugfix: Prevent duplicate WIF Store entries after restarting.
+- Change: Block `SIGHASH_SINGLE` and `SIGHASH_SINGLE|ANYONECANPAY` by default because they can
+ leave later transaction outputs modifiable after signing. They remain available when Sighash
+ Checks is set to Warn.
+ Thanks to [@instagibbs](https://github.com/instagibbs) for reporting this issue.
+- Bugfix: Prevent PSBT uploads from being mistaken for partial firmware uploads.
+- Bugfix: Harden callgate buffer validation against integer overflow and out-of-range access,
+ following a finding in the [Karma-X security review](https://karma-x.io/blog/post/75/).
+- Bugfix: Reject firmware update data beyond the signed firmware length.
+- Bugfix: Reject out-of-range firmware high-water timestamps without triggering a
+ bootloader assertion.
+- Bugfix: USB `dwld` allowed readback of arbitrary staged PSRAM content (uploaded
+ PSBT, multisig enroll file), also across sessions and over plaintext links.
+ Downloads are now limited to the single most recent result produced for
+ download (signed txn, visualization, backup), require an encrypted session,
+ and are invalidated by any upload, newly staged PSRAM content (including
+ Q-specific PSBT and BBQr paths), or new session. Thanks to
+ [@drk1wi](https://github.com/drk1wi) for reporting this issue.
+- Change: When a BIP-39 passphrase is active, View Seed Words now shows only the effective
+ extended private key instead of the underlying seed words.
+ - Bugfix: View Seed Words and backup workflows incorrectly treated the master seed as the
+ parent of every BIP-39 passphrase wallet. When a passphrase was applied to a temporary seed,
+ they could not access that immediate parent seed.
+ - Change: Backup System, Clone Coldcard, and Key Teleport’s Full COLDCARD Backup now capture
+ the wallet secret currently in effect, including temporary seeds and BIP-39 passphrase
+ wallets, and warn before export.
+- Bugfix: A compromised USB host could rewrite the staged PSBT after review, but
+ before signing, so the signature covered a different transaction than shown.
+ Staged bytes are now re-verified before signing; any change aborts with
+ "Transaction modified". Thanks to "FreeZ Agent" for the report and proof of concept.
+- Bugfix: Reject duplicate cosigner keys and keys the device already holds
+ during multisig wallet enrollment. Thanks to [@drk1wi](https://github.com/drk1wi)
+ for reporting this.
+- Bugfix: Reject backup files that request excessive password-derivation work.
+- Bugfix: Require unique multisig wallet names, generate unique default names,
+ and reject ambiguous lookups of legacy duplicate names.
+- Change: Multisig wallet names can now be changed with a dedicated `Rename`
+ action in the wallet menu. Reimporting an enrollment file or descriptor no
+ longer renames an existing wallet.
+- Bugfix: Separate the SE1 check nonce from the PIN digest. Thanks to
+ [@instagibbs](https://github.com/instagibbs) for reporting this issue.
+- Bugfix: Clear volatile PSRAM application data when the seed is wiped.
+- Enhancement: Clone Coldcard now shows the restored seed's master fingerprint on the receiving
+ Coldcard and asks for confirmation before installing it.
+- Bugfix: CCC velocity policies created by older firmware now enforce the
+ current chain's minimum block height before co-signing.
+- Bugfix: USB backup restore now respects the Spending Policy's Related Keys setting.
+- Bugfix: Reject overlong Base58Check payloads before decoding beyond the destination buffer.
+- Bugfix: Reject SegWit addresses with oversized HRPs instead of returning an unterminated buffer.
+
+# Mk Specific Changes
+
+## 5.6.1 - 2026-08-20
+
+- all of the above.
-**Urgent hotfix to correct a limited entropy bug**
-Please regenerate seeds only with this new version of the firmware and any
-later updates from today onwards.
+# Q Specific Changes
-**Mk3 users must regenerate any seeds** made on earlier versions
-as their entropy is critically low at just ~40 bits.
+## 1.5.1Q - 2026-08-20
-On **Mk4, Mk5 and Q entropy** may be as low as ~72 bits. This is
-well below our target of 128 bits.
+- Security Improvement: Require scrolling to reveal locally entered BIP-39 passphrases.
+- Bugfix: Reject malformed multipart BBQrs that could include stale PSRAM bytes
+ in decoded results. Thanks to [@drk1wi](https://github.com/drk1wi) for reporting this.
+- Defence-in-depth hardening:
+ - Sanitize control characters in BIP-21 payment metadata values and
+ parameter names before display.
+ - Reject oversized multisig coordinator BBQr imports before JSON parsing to prevent memory
+ exhaustion.
+ - Revoke USB download access before staging PSBT and BBQr data in PSRAM.
+- Bugfix: Allow Send Password to temporarily enable USB keyboard emulation when
+ USB is disabled in settings.
-Follow the steps listed in
-[our blog announcement](https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/)
-to be safe, and please be careful not to cut corners or rush this process.
# Release History
### releases/Next-ChangeLog.md
@@ -4,119 +4,17 @@ This lists the new changes that have not yet been published in a normal release.
# Shared Improvements - Both Mk and Q
-- Improvements to Entropy Generation:
- - Master seed generation now combines fresh entropy from the STM32 TRNG,
- SE1, and SE2. Previously, SE1 and SE2 contributed through boot-time RNG
- seeding; they are now also sampled directly for each new master seed.
- - On every boot, RNG is seeded with the full 256-bit digest of entropy
- from both Secure Elements (previously truncated to 32 bits).
- - libngu now uses a `SHA-256 Hash_DRBG` (NIST SP 800-90A) instead of the Yasmarang PRNG.
- - Backup passwords, encryption salt/IV, and 2FA secrets now use libngu's
- Hash_DRBG-based RNG instead of calling the raw TRNG interface directly.
- Remaining direct application uses of the raw TRNG are for non-secret values.
- - RNG self-test proves `rng_get()` enters the hardware read path and stops
- the boot if the check fails.
- - Build-time checks verify that libngu's random-byte path reaches the
- hardware `rng_get()` implementation.
-- Newly generated master seeds, Temporary Seeds, and CCC key C now **require**
- extra user-supplied entropy (dice, coin flips, or keyboard mashing):
- - Choose key mashing (based on [Peter Todd's Push-Button RNG](https://petertodd.org/2014/push-button-rng)),
- physical dice rolls or physical coin flips.
- - Entropy supplied by the user is added to randomness from the STM32 TRNG,
- SE1, and SE2. It does not replace those sources.
- - Dice and coin results are checked for obviously bad distributions.
- - Key mashing hashes raw GPIO press timing captured at CPU-cycle
- resolution (~8.33 ns at 120 MHz) before keypad debounce. Releases are ignored,
- repeating one key is valid, and at least 65 presses are required. The first
- press establishes the timing reference; each of the following 64 inter-press
- gaps is conservatively credited with two bits of entropy. The full timing
- delta and key identity are mixed in, but key identity receives no entropy credit.
- Users may continue mashing beyond 65 presses to contribute additional timing entropy.
-- Dice-Only Enhancements:
- - Dice-only seed generation now clearly warns: **NO hardware entropy is
- included.** The final hash shown on screen must be kept secret.
- - Temporary dice-only seeds now use the same warning and mandatory
- entropy checks as master dice-only seeds.
- - Held digit keys count as one dice roll, and completion keys now match
- each COLDCARD model.
-- Delta Mode hardening:
- - Wipe seed in Delta Mode when saved BIP-39 passphrases are listed, instead of revealing them.
- - Block access to Seed Vault entries through Key Teleport's secret picker,
- CCC key-C import, and Seed XOR restore in Delta Mode. Thanks to "Rety"
- for reporting the Seed XOR issue.
- - Wipe seed before BIP-85 derivation in Delta Mode.
- - Prevent valid message signatures when using a Delta Mode PIN.
-- Bugfix: Detect `RNG_SR_SEIS` and `RNG_SR_SECS`, retry safely, and fail closed on persistent faults.
-- Bugfix: BIP-322 message signing now rejects non-ASCII and other unsupported
- message text before approval. Thanks to [@KirillCherikov](https://github.com/KirillCherikov) for reporting.
-- Bugfix: Prevent duplicate WIF Store entries after restarting.
-- Change: Block `SIGHASH_SINGLE` and `SIGHASH_SINGLE|ANYONECANPAY` by default because they can
- leave later transaction outputs modifiable after signing. They remain available when Sighash
- Checks is set to Warn.
- Thanks to [@instagibbs](https://github.com/instagibbs) for reporting this issue.
-- Bugfix: Prevent PSBT uploads from being mistaken for partial firmware uploads.
-- Bugfix: Harden callgate buffer validation against integer overflow and out-of-range access,
- following a finding in the [Karma-X security review](https://karma-x.io/blog/post/75/).
-- Bugfix: Reject firmware update data beyond the signed firmware length.
-- Bugfix: Reject out-of-range firmware high-water timestamps without triggering a
- bootloader assertion.
-- Bugfix: USB `dwld` allowed readback of arbitrary staged PSRAM content (uploaded
- PSBT, multisig enroll file), also across sessions and over plaintext links.
- Downloads are now limited to the single most recent result produced for
- download (signed txn, visualization, backup), require an encrypted session,
- and are invalidated by any upload, newly staged PSRAM content (including
- Q-specific PSBT and BBQr paths), or new session. Thanks to
- [@drk1wi](https://github.com/drk1wi) for reporting this issue.
-- Change: When a BIP-39 passphrase is active, View Seed Words now shows only the effective
- extended private key instead of the underlying seed words.
- - Bugfix: View Seed Words and backup workflows incorrectly treated the master seed as the
- parent of every BIP-39 passphrase wallet. When a passphrase was applied to a temporary seed,
- they could not access that immediate parent seed.
- - Change: Backup System, Clone Coldcard, and Key Teleport’s Full COLDCARD Backup now capture
- the wallet secret currently in effect, including temporary seeds and BIP-39 passphrase
- wallets, and warn before export.
-- Bugfix: A compromised USB host could rewrite the staged PSBT after review, but
- before signing, so the signature covered a different transaction than shown.
- Staged bytes are now re-verified before signing; any change aborts with
- "Transaction modified". Thanks to "FreeZ Agent" for the report and proof of concept.
-- Bugfix: Reject duplicate cosigner keys and keys the device already holds
- during multisig wallet enrollment. Thanks to [@drk1wi](https://github.com/drk1wi) for reporting this.
-- Bugfix: Reject backup files that request excessive password-derivation work.
-- Bugfix: Require unique multisig wallet names, generate unique default names,
- and reject ambiguous lookups of legacy duplicate names.
-- Change: Multisig wallet names can now be changed with a dedicated `Rename`
- action in the wallet menu. Reimporting an enrollment file or descriptor no
- longer renames an existing wallet.
-- Bugfix: Separate the SE1 check nonce from the PIN digest. Thanks to
- [@instagibbs](https://github.com/instagibbs) for reporting this issue.
-- Bugfix: Clear volatile PSRAM application data when the seed is wiped.
-- Enhancement: Clone Coldcard now shows the restored seed's master fingerprint on the receiving
- Coldcard and asks for confirmation before installing it.
-- Bugfix: CCC velocity policies created by older firmware now enforce the
- current chain's minimum block height before co-signing.
-- Bugfix: USB backup restore now respects the Spending Policy's Related Keys setting.
-- Bugfix: Reject overlong Base58Check payloads before decoding beyond the destination buffer.
-- Bugfix: Reject SegWit addresses with oversized HRPs instead of returning an unterminated buffer.
+- tbd
# Mk Specific Changes
-## 5.6.1 - 2026-08-20
+## 5.6.x - 2026-0x-xx
-- all of the above.
+- tbd
# Q Specific Changes
-## 1.5.1Q - 2026-08-20
+## 1.5.xQ - 2026-0x-xx
-- Security Improvement: Require scrolling to reveal locally entered BIP-39 passphrases.
-- Bugfix: Reject malformed multipart BBQrs that could include stale PSRAM bytes
- in decoded results. Thanks to [@drk1wi](https://github.com/drk1wi) for reporting this.
-- Defence-in-depth hardening:
- - Sanitize control characters in BIP-21 payment metadata values and
- parameter names before display.
- - Reject oversized multisig coordinator BBQr imports before JSON parsing to prevent memory
- exhaustion.
- - Revoke USB download access before staging PSBT and BBQr data in PSRAM.
-- Bugfix: Allow Send Password to temporarily enable USB keyboard emulation when
- USB is disabled in settings.
+- tbdRisk score
Our methodology →Why this scored 100/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.