Important security update for anyone using a COLDCARD. A serious vulnerability has been disclosed involving the randomness used by some COLDCARD devices when generating Bitcoin seeds. If you use one, move your bitcoin to a new seed generated elsewhere.

@COLDCARDwallet you're about three days late but thanks

@COLDCARDwallet I already posted about it on all my social media and emailed my mailing list within hours of it happening.

@COLDCARDwallet Pretty late disclaimer, considering how heavily you pushed the ColdCard in your podcast. At this stage the only relevant tidbit of information is if you plan to keep promoting Coinkite hardware wallets to your audience or not.

@COLDCARDwallet I already posted about it on all my social media and emailed my mailing list within hours of it happening. And no, I won't promote it anymore.

If you use another wallet today but generated the seed on a COLDCARD, you should also move your bitcoin. First, reassurance: if you generated your own seed with at least 50 fair, independent, private dice rolls, you're not at risk from this specific vulnerability.

A strong passphrase also provides additional protection. Several COLDCARD devices and seeds fall outside the affected firmware ranges. But my recommendation is simpler than working out which model you have, which firmware it ran years ago, and how many dice rolls you used.

Whether you remember every detail correctly, and whether further vulnerabilities may be found, are open questions too. With something as important as your bitcoin, I would rather eliminate the uncertainty than take a risk we don't need to take.

If you rolled your own dice more than 50 times and have a strong passphrase, you probably have more time. If you relied on the device to produce the randomness, you need to act immediately.

Either way, act decisively and with high focus. Use whichever migration option you are most comfortable and competent with. Rushing a Bitcoin transaction or improvising a security setup you don't understand can create its own risks.

If you're migrating to another hardware wallet or an airgapped computer you understand well: Generate a completely new seed on an unaffected device you know is safe from bugs and is not connected to the internet.

Carefully record and verify the new seed backup. Verify the wallet fingerprint and receiving address on the hardware wallet or airgapped computer itself. Do not simply trust what your online computer or phone shows you.

Send a small test transaction. Confirm everything works and that you can access and spend from the new wallet before moving the remaining funds. Keep your old seed backup until you have fully verified the migration is complete.

Not comfortable setting up another self-custody wallet immediately? Another option is to temporarily move the bitcoin to a reputable exchange or custodian you already trust, while you establish a new self-custody setup properly.

Again, the point is not to rush. Choose the option you understand best. But do move.

A strong, unique BIP-39 passphrase is an additional independent security barrier. Sufficient private dice entropy also protects you from this particular randomness problem. Personally, I would still create a fresh seed elsewhere.

One final warning: scammers will absolutely try to exploit this. Never give your seed words or passphrase to anyone. Never enter them into a website, chatbot, unsolicited recovery tool, or a link somebody sends you. Nobody helping you migrate needs your seed words.

Don't panic. Don't ignore it either. Take your time, verify every step, and move your funds in whatever safe way you are most comfortable with.

Hold on to all your old devices and seed backups. They may be useful in demonstrating ownership of the coins if the hacker is ever caught.

Follow the latest disclosures from @Coinkite to understand whether your device is affected, and keep following updates here as the situation develops.

@stephanlivera @COLDCARDwallet You're a bit late, given how heavily you've pushed that thing...

@COLDCARDwallet Wow bit late to the game 👀

@COLDCARDwallet I already posted about it on all my social media and emailed my mailing list within hours of it happening.

@COLDCARDwallet Point taken

@COLDCARDwallet Shill

@COLDCARDwallet You can’t take back the damage you’ve done to Bitcoin

@COLDCARDwallet You been living under a rock the last few days, or making sure your tweets were properly spell checked?

@COLDCARDwallet Folks don't let your Coldcard touch Internet NVK gave you 9 volt air gap solution yrs ago Catch up

@COLDCARDwallet You're awfully late. Nearly all of them that didn't have a passphrase have already been drained by now.

@COLDCARDwallet Wow, 2 days later. If you were on an mk3 youre bitcoin is gone by now. Anyone know if this hotshot ever stressed the importance of entropy,dice, and passphrases in the past?

@COLDCARDwallet This was 72 to 48 hours ago, man. Too late. 🥲

@COLDCARDwallet Delete your account

@COLDCARDwallet Saif, would you feel safe to still be using the Q hardware that generated a new seed phrase AFTER the firmware was updated and an added passphrase was also used?

@COLDCARDwallet No

@COLDCARDwallet Thanks. Is your “no” based on evidence that 1.5.0Q still generates inadequate entropy, or simply a loss of trust in Coinkite? Would you use the Q only as an air-gapped signer after importing a seed generated independently on another device?

@COLDCARDwallet Preferably that has zero Israeli technology in it

@COLDCARDwallet The amount of stupidity in the comments is absurd

@COLDCARDwallet Right on time

@COLDCARDwallet If they waited until BTC went down 50% to do this does it mean confidence it'll go back up soon cause at the rate it's depreciateling you almost don't need to worry about anyone stealing it.

@COLDCARDwallet Richard Heart already warned us beforehand so we were ONCE AGAIN unaffected. So much soy in this industry.

@COLDCARDwallet Funny, you endorsed it, no doubt paid to do so

@COLDCARDwallet Why did You shill it heavily on your channels? Will you be accountable for the loses that came from your recommendation?

@COLDCARDwallet Just tell people to move Bitcoin to trusted custodians or ETFs. Much simpler. Now do you understand why people trusted banks to hold their gold?

@COLDCARDwallet I just wonder - who wants to go through all this and constantly live in fear of getting hacked one day ? BTC has lost a lot of attractiveness lately -

@COLDCARDwallet

@COLDCARDwallet Better late than never ...

@COLDCARDwallet A little (2 days) late?

@COLDCARDwallet 🤣🤣🤣 were you touting this bullshit? You should be held liable alongside them, bozo

😲 Obviously, that's an extremely big joke. ✌️ That's why the #MostSecure @AtlantisWallet is the better choice for more and more #Web3 users worldwide! 🔐 Atlantis Wallet is perfectly protected by Atlantis #QuantumLock. 👉 To register your better cold wallet and for permanently free use, visit: 🔗 👆👆👆👆👆 👆👆👆👆 👆👆👆

@COLDCARDwallet Never too late to get some exposure? Marketing on the backs off people who lost their lives savings? unbelievable to come out with AI slop from a non SecOps expert, I hate it here.

@COLDCARDwallet In your podcast with NVK he tried to clown on you for generating a private key on a laptop and then binning the laptop... hardware wallets like SeedSigner where you make your own entropy (dice rolls/raffle) are seriously redeemed right now and deserve attention

@COLDCARDwallet Dude a bit late

@COLDCARDwallet better late than never🤷‍♂️

@COLDCARDwallet

@COLDCARDwallet Will you be returning all of the funds you received for shilling our products? Only fair!

@COLDCARDwallet Are you receiving sponsor money for this?