{"id":12244,"date":"2026-08-23T05:24:18","date_gmt":"2026-08-23T05:24:18","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=12244"},"modified":"2026-08-23T05:24:18","modified_gmt":"2026-08-23T05:24:18","slug":"coldcard-now-requires-65-key-presses-after-seed-exploit-while-exposed-funds-still-must-move","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=12244","title":{"rendered":"Coldcard now requires 65 key presses after seed exploit, while exposed funds still must move"},"content":{"rendered":"<p><\/p>\n<div data-single-article-content=\"\">\n<p>Coinkite, the maker of the Coldcard Bitcoin hardware wallet, released new standard firmware on Aug. 20 that forces users to add physical randomness whenever they generate a seed.<\/p>\n<p>Owners who generate a seed after installing the current fixed release can use the hardened process. Owners still relying on a seed produced by affected firmware must generate another seed and transfer the funds unless that wallet meets the dice-roll exception.<\/p>\n<p>During standard seed creation, every seed combines fresh device entropy with one required human input source: at least 65 key presses made at unpredictable intervals, 50 rolls of a physical six-sided die, or 128 physical coin flips. The requirement reduces reliance on the wallet&#8217;s random-number generator alone.<\/p>\n<p>Coldcard&#8217;s current security status recommends version 5.6.1 for Mk4 and Mk5 devices and 1.5.1Q for Q devices. The advisory&#8217;s exposure list is wider and track-specific. Coinkite&#8217;s official migration guidance covers Mk2 and Mk3 firmware 4.0.1 through 4.1.9; Mk4 and Mk5 standard firmware before 5.6.0 and Edge firmware before 6.6.0X; and Q standard firmware before 1.5.0Q and Edge firmware before 6.6.0QX.<\/p>\n<p>Block&#8217;s independent technical analysis uses a broader Mk2 and Mk3 boundary that includes version 4.0.0. Owners of that release should not treat the vendor boundary as proof of safety.<\/p>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">A flaw in Coldcard seed generation lets attackers recreate private keys from the press of a button<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<p>Installing fixed firmware does not change an old seed. Unless the advisory&#8217;s dice exception applies, Coinkite&#8217;s migration guide tells affected users to generate a genuinely new seed, verify its backup and wallet fingerprint, confirm a receiving address on the device, send a small test transaction, and then transfer every balance tied to the old seed. Cloning or restoring the wallet does not create a new seed.<\/p>\n<aside id=\"cs-inline-newsletter-1\" class=\"cs-inline-newsletter\" data-inline-newsletter=\"\" data-newsletter-placement=\"article-midpoint\" data-newsletter-pending-label=\"Joining\u2026\" data-newsletter-pending-status=\"Joining the Daily Brief\u2026\" data-newsletter-email-required-message=\"Before sending, please provide your email address.\" aria-labelledby=\"cs-inline-newsletter-1-title\" aria-describedby=\"cs-inline-newsletter-1-copy\">\n<div class=\"cs-inline-newsletter__inner\">\n<div class=\"cs-inline-newsletter__content\"> <span class=\"cs-inline-newsletter__eyebrow\"> <i class=\"fa-regular fa-envelope\" aria-hidden=\"true\"\/> The Daily Brief <\/span><\/p>\n<h2 id=\"cs-inline-newsletter-1-title\" class=\"cs-inline-newsletter__title\">The signal, before the noise.<\/h2>\n<p id=\"cs-inline-newsletter-1-copy\" class=\"cs-inline-newsletter__copy\">Start your day with the crypto stories moving markets, decoded by CryptoSlate\u2019s editors.<\/p>\n<\/div>\n<div class=\"cs-inline-newsletter__form-shell\">\n<p class=\"cs-inline-newsletter__form-heading\">One email. Everything that matters.<\/p>\n<p id=\"cs-inline-newsletter-1-privacy\" class=\"cs-inline-newsletter__privacy\">Free to join. Unsubscribe any time.<\/p>\n<p> <i class=\"fa-regular fa-circle-xmark\" aria-hidden=\"true\"\/> <span>Whoops, looks like there was a problem. Please try again.<\/span><\/p>\n<p> <i class=\"fa-regular fa-circle-check\" aria-hidden=\"true\"\/> <span><strong>You\u2019re on the list.<\/strong> Your next Daily Brief is on its way.<\/span><\/p>\n<\/div>\n<\/div>\n<\/aside>\n<p>Migration is not required for this RNG flaw when the user added at least 50 fair, independent and private physical die rolls through the affected workflow and never recorded or exposed the sequence. Fewer rolls, or uncertainty about those conditions, means the user should migrate.<\/p>\n<p>Block traced the original defect to code that could route requests to a deterministic MicroPython fallback because a feature flag defined as zero was treated as present. Mandatory human input adds outside entropy to new standard seeds, limiting damage if device randomness fails again. It cannot retroactively add entropy to a seed that already exists.<\/p>\n<p><img fetchpriority=\"high\" decoding=\"async\" class=\"aligncenter wp-image-557167\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/08\/exec-201333e5-e7fa-4a51-bd63-cc37f86f58fb.png\" alt=\"Flowchart showing when Coldcard users need only hardened seed creation and when affected seeds require an on-chain fund migration\" width=\"720\" height=\"899\"\/><img decoding=\"async\" class=\"lazyload aligncenter wp-image-557167\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/08\/exec-201333e5-e7fa-4a51-bd63-cc37f86f58fb.png\" alt=\"Flowchart showing when Coldcard users need only hardened seed creation and when affected seeds require an on-chain fund migration\" width=\"720\" height=\"899\"\/><\/p>\n<p>Coldcard treats the mixed flow differently from the advanced Dice Rolls Only option. That mode excludes hardware randomness and requires 50 rolls for a 12-word seed or 99 for a 24-word seed.<\/p>\n<p>The firmware package reaches signing and data paths too. It binds USB review to a staged PSBT checksum, rechecks transaction bytes before signing, blocks SIGHASH_SINGLE modes by default, restricts USB downloads to the current encrypted-session result, and validates firmware file length. It adds persistent RNG-fault stops, a boot-time hardware-RNG linkage check, more Delta Mode isolation, and active-wallet backup behavior.<\/p>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">CryptoBandits malware lets criminals use your USB drive to access crypto wallets \u2013 Microsoft warns<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<p>The status page lists targeted source review, a real-device RNG-path test, and a reproducible build and dice-path trace, but Coldcard says they do not amount to a full audit of every fixed binary. Coinkite says some customers suffered severe losses and law enforcement is investigating, but it has not published a verified victim count or loss total.<\/p>\n<\/div>\n<p>Featured,Hacks,Technology,Wallets,Bitcoin,Block,ColdcardBitcoin,Block,Coldcard#Coldcard #requires #key #presses #seed #exploit #exposed #funds #move1787462658<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Coinkite, the maker of the Coldcard Bitcoin hardware wallet, released new standard firmware on Aug. 20 that forces users to add physical randomness whenever they generate a seed. Owners who generate a seed after installing the current fixed release can use the hardened process. Owners still relying on a seed produced by affected firmware must<\/p>\n","protected":false},"author":1,"featured_media":12245,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[91,1277,5845,664,532,1238,1562,302,4054,6450,3374],"class_list":["post-12244","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ethereum","tag-bitcoin","tag-block","tag-coldcard","tag-exploit","tag-exposed","tag-funds","tag-key","tag-move","tag-presses","tag-requires","tag-seed"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v26.6) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Coldcard now requires 65 key presses after seed exploit, while exposed funds still must move - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"description\" content=\"Firmware 5.6.1 and 1.5.1Q harden new wallet creation but cannot repair a seed made on an affected release.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=12244\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Coldcard now requires 65 key presses after seed exploit, while exposed funds still must move\" \/>\n<meta property=\"og:description\" content=\"Firmware 5.6.1 and 1.5.1Q harden new wallet creation but cannot repair a seed made on an affected release.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=12244\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-23T05:24:18+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/coldcard-keypress-seed-security.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12244\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=12244\",\"name\":\"Coldcard now requires 65 key presses after seed exploit, while exposed funds still must move - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12244#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12244#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/coldcard-keypress-seed-security.jpg\",\"datePublished\":\"2026-08-23T05:24:18+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"description\":\"Firmware 5.6.1 and 1.5.1Q harden new wallet creation but cannot repair a seed made on an affected release.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12244#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=12244\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12244#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/coldcard-keypress-seed-security.jpg\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/coldcard-keypress-seed-security.jpg\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12244#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Coldcard now requires 65 key presses after seed exploit, while exposed funds still must move\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto &amp; Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Coldcard now requires 65 key presses after seed exploit, while exposed funds still must move - Crypto News: Latest Cryptocurrency News and Analysis","description":"Firmware 5.6.1 and 1.5.1Q harden new wallet creation but cannot repair a seed made on an affected release.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=12244","og_locale":"en_US","og_type":"article","og_title":"Coldcard now requires 65 key presses after seed exploit, while exposed funds still must move","og_description":"Firmware 5.6.1 and 1.5.1Q harden new wallet creation but cannot repair a seed made on an affected release.","og_url":"https:\/\/cryptonews.uk.com\/?p=12244","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-08-23T05:24:18+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/coldcard-keypress-seed-security.jpg","type":"image\/jpeg"}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=12244","url":"https:\/\/cryptonews.uk.com\/?p=12244","name":"Coldcard now requires 65 key presses after seed exploit, while exposed funds still must move - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=12244#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=12244#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/coldcard-keypress-seed-security.jpg","datePublished":"2026-08-23T05:24:18+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"description":"Firmware 5.6.1 and 1.5.1Q harden new wallet creation but cannot repair a seed made on an affected release.","breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=12244#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=12244"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=12244#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/coldcard-keypress-seed-security.jpg","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/coldcard-keypress-seed-security.jpg","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=12244#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"Coldcard now requires 65 key presses after seed exploit, while exposed funds still must move"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto &amp; Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/12244","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=12244"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/12244\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/12245"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12244"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12244"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12244"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}