docs: add Coldcard Mk3 seed-entropy security notice to plugin README (#10805)
What the developer wrote
Authored by Róbert Nagy
docs: add Coldcard Mk3 seed-entropy security notice to plugin README (#10805)
* docs: warn about Coldcard Mk3 seed-entropy advisory (Coinkite, Jul 2026)
* docs: remove unicode from Coldcard security notice (per maintainer request)
What changed, and why it matters
This commit only adds a documentation warning to Electrum's Coldcard plugin README. It does not change any executable code, cryptographic logic, or wallet behavior. The warning tells users that Coldcard/Coinkite disclosed a firmware bug in certain Coldcard devices that could make on-device seeds easier to guess, and advises updating firmware and moving funds. Because Electrum itself is not being patched for a vulnerability, this commit is not a security fix for Electrum.
No action is required for Electrum itself. Users of affected Coldcard hardware should follow Coinkite's advisory: update to fixed firmware, generate a new seed, and move funds.
Security signals we found
Documentation-only change
References an external hardware-wallet firmware advisory
No code, cryptography, or plugin behavior modified
Evidence from the diff
The diff adds a ‘Security notice’ section to electrum/plugins/coldcard/README.md referencing a Coinkite advisory about reduced seed entropy on Coldcard Mk3 (firmware 4.0.1-5.0.3) and pre-fix Mk4/Q units. No source code, plugin logic, USB API, or seed-handling code is modified. The change is purely informational documentation.
Changed components
electrum/plugins/coldcard/README.mdInspect captured patch +4 / −0
### electrum/plugins/coldcard/README.md
@@ -1,5 +1,9 @@
# Coldcard Hardware Wallet Plugin
+## Security notice
+
+Coinkite disclosed (July 2026) a firmware build error that reduced generated-seed entropy on **Coldcard Mk3** (firmware 4.0.1-5.0.3) and pre-fix **Mk4/Q**. Seeds generated on-device without extra dice rolls may be brute-forceable. Update to fixed firmware, generate a new seed and move your funds. See the [Coinkite advisory](https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/).
+
## Just the glue please
This code connects the public USB API and Electrum. Leverages allWhy this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.