Merge pull request #10829 from nrobi144/coldcard-firmware-range-fix
What the developer wrote
Authored by ThomasV
Merge pull request #10829 from nrobi144/coldcard-firmware-range-fix
docs: correct Coldcard firmware range in seed-entropy notice
What changed, and why it matters
This commit only updates a documentation file (a README) to correct the range of Coldcard hardware wallet firmware versions affected by a previously disclosed security issue. It does not change any executable code, cryptographic logic, or wallet behavior in Electrum itself. The underlying security problem exists in Coldcard firmware, not in Electrum.
No action required for Electrum users beyond reviewing the corrected documentation. Users of affected Coldcard devices should follow Coinkite's advisory to update firmware and rotate seeds if applicable.
Security signals we found
Documentation-only change
References an external hardware-wallet firmware vulnerability
No code, cryptographic, or plugin logic changes
Evidence from the diff
The diff modifies electrum/plugins/coldcard/README.md, changing the security notice text. The old text listed Coldcard Mk3 firmware 4.0.1-5.0.3 and pre-fix Mk4/Q as affected. The new text lists Mk2/Mk3 firmware 4.0.1-4.1.9 and Mk4/Mk5/Q before their fixed firmware, and changes the mitigation wording from ‘without extra dice rolls’ to ‘with fewer than 50 independent dice rolls’. No code changes are present.
Changed components
electrum/plugins/coldcard/README.mdInspect captured patch +1 / −1
### electrum/plugins/coldcard/README.md
@@ -2,7 +2,7 @@
## Security notice
-Coinkite disclosed (July 2026) a firmware build error that reduced generated-seed entropy on **Coldcard Mk3** (firmware 4.0.1-5.0.3) and pre-fix **Mk4/Q**. Seeds generated on-device without extra dice rolls may be brute-forceable. Update to fixed firmware, generate a new seed and move your funds. See the [Coinkite advisory](https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/).
+Coinkite disclosed (July 2026) a firmware build error that reduced generated-seed entropy on **Coldcard Mk2/Mk3** (firmware 4.0.1-4.1.9) and **Mk4/Mk5/Q** before their fixed firmware. Seeds generated on-device with fewer than 50 independent dice rolls may be brute-forceable. Update to fixed firmware, generate a new seed and move your funds. See the [Coinkite advisory](https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/).
## Just the glue please
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.