What the developer wrote
Authored by Peter D. Gray
edits
What changed, and why it matters
This commit is only a wording edit to the COLDCARD firmware changelog, but the changelog text itself discloses a serious security problem: some COLDCARD devices generated wallet seeds with far less randomness than intended. Mk3 devices running firmware 4.0.1 or later produced seeds with only about 40 bits of entropy, while Mk4, Mk5 and Q devices produced seeds with as little as about 72 bits. Because wallet seeds protect cryptocurrency funds, low entropy means an attacker with knowledge of the bug could potentially guess a user's seed and steal funds. The vendor calls this an 'urgent hotfix' and tells affected users to regenerate their seeds. This edit does not change any code; it only clarifies and rewords the warning.
Users should follow Coinkite's blog guidance immediately: upgrade to the hotfix firmware, regenerate any seed created on affected firmware versions, and move funds to the new seed. Mk3 users should either migrate to newer hardware or protect the weak seed with a strong BIP-39 passphrase. Developers and security reviewers should locate the actual entropy-generation code change in the corresponding firmware release and verify that the fix restores full intended entropy.
Security signals we found
Vendor self-disclosed 'urgent hotfix to correct a limited entropy bug'
Cryptographic randomness/entropy reduction in seed generation
Advisory tells users to regenerate seeds and use newer hardware or BIP-39 passphrase
Mk3 devices declared unpatched ('not planning to update Mk3 firmware at this time')
Blog announcement link provided for remediation steps
Evidence from the diff
The diff modifies releases/ChangeLog.md. It renames a release heading and rewords the advisory about a ‘limited entropy bug.’ Key technical claims in the text: Mk3 seeds created on firmware 4.0.1 or later have ~40 bits of entropy; Mk4/Mk5/Q seeds may have ~72 bits; the target was 128 bits (previously stated as 256 bits in the earlier wording). The commit does not contain the actual entropy fix; it is a documentation-only edit. The security relevance is therefore inferred from the vendor’s own changelog disclosure, not from code changes in this commit.
Changed components
COLDCARD Mk3 seed generation (firmware 4.0.1 and later)COLDCARD Mk4 seed generationCOLDCARD Mk5 seed generationCOLDCARD Q seed generationreleases/ChangeLog.md documentationInspect captured patch +8 / −8
diff --git a/releases/ChangeLog.md b/releases/ChangeLog.md
index eaff034..91ae01c 100644
--- a/releases/ChangeLog.md
+++ b/releases/ChangeLog.md
@@ -2,20 +2,20 @@
This lists the changes in the most recent firmware, for each hardware platform.
-## 5.5.2 - 2026-07-30 & 1.4.2Q - 2026-07-30
+## 2026-07-31 Hotfix Versions: 5.5.2 & 1.4.2Q
**Urgent hotfix to correct a limited entropy bug.**
Please regenerate seeds only with this version of the firmware and any
-later updates from today.
+later updates from today onwards.
-**Mk3 users must regenerate any seeds** made on Mk3 hardware after
-version 4.0.1 as their entropy is critically low at just ~40 bits.
-We are not planning to update Mk3 firmware at this time, so please
-use newer hardware or add a BIP-39 passphrase.
+**Mk3 users must regenerate any seeds** made on version 4.0.1 or
+later as their entropy is critically low at just ~40 bits. We are
+not planning to update Mk3 firmware at this time, so please use
+newer hardware or add a BIP-39 passphrase as a stopgap.
-On Mk4, Mk5 and Q entropy may be as low as ~72 bits. This is well below
-our target of 256 bits.
+On **Mk4, Mk5 and Q entropy** may be as low as ~72 bits. This is
+well below our target of 128 bits.
Follow the steps listed in
[our blog announcement](https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/)
Why this scored 90/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.