Comparison
COLDCARD vs Trezor (2026)
7 min read
| COLDCARD Mk4 / Mk5 / Q | Trezor Safe 3 / 5 / 7 | |
|---|---|---|
| Our status | Advanced only, new seeds only | Recommended, PIN always set |
| Minimum firmware | Current 5.6.3 / 1.5.3Q (fix first shipped in 5.6.0 / 1.5.0Q) | 2.12.5+ |
| 2026 events | Weak-seed RNG flaw; thefts from July 30, 2026 | Several issues fixed in current firmware |
COLDCARD in 2026
A firmware random-number error produced weak seeds that attackers brute-forced offline. Galaxy Research tallied 1,778.84 BTC in high-confidence losses by August 14, 2026 (Galaxy). Updating firmware does not fix an existing seed; Coinkite's guidance is to create a new seed on fixed firmware and move funds (COLDCARD migration).
Trezor in 2026
Trezor disclosed and fixed a multisig verification bug and a lock bypass in an SD-protect-only configuration, among others (Trezor; Trezor). Always set a PIN and stay on current firmware.
Which should you pick?
- First device, want it simple: Trezor Safe (or BitBox02 / Jade).
- Experienced and comfortable with advanced settings: COLDCARD on current firmware with a freshly generated seed, ideally as one key in a multisig with a different vendor.
- Either way: buy direct, verify firmware on the screen, and run a restore test.
Sources
- Coinkite advisory
- COLDCARD security status
- COLDCARD migration
- COLDCARD downloads
- Galaxy Research (Oct 16, 2026)
- Galaxy Research (Aug 14, 2026)
- Cointelegraph (Aug 25, 2026)
- BlockSec analysis
- Cointelegraph: X phishing post (Oct 11, 2026)
- COLDCARD on X (@COLDCARDwallet)
- Trezor firmware changelog
- Trezor: multisig verification bug
- Trezor: lock bypass
- ENISA EUVD-2026-46400
- Decrypt: Trezor cuts resellers
- Trezor: Brevo incident (Sep 10, 2026; updated Sep 17)
Educational content only, not financial advice. See our disclosure.