COLDCARD

What it is

COLDCARD is Coinkite's Bitcoin-only hardware wallet, designed for air-gapped signing (coldcard.com).

At a glance

Current security status

Advanced only: Advanced users only, new seeds only. Minimum version: Current 5.6.3 / 1.5.3Q (fix first shipped in 5.6.0 / 1.5.0Q). Checked Oct 17, 2026 on our security watch.

• A firmware RNG integration error produced weak seeds; affected seeds were brute-forced offline and thefts began July 30, 2026. The devices were not remotely hacked.
• Galaxy Research's latest count (Oct 16, 2026): more than 1,830 BTC has been swept from more than 9,000 addresses. Earlier counts: 1,778.84 BTC from 8,600+ addresses (Aug 14) and about 1,789 BTC from 8,865 addresses (Aug 25).
• Updating firmware does not repair an existing seed. Make a new seed on fixed firmware and move funds.
• Oct 11, 2026: an unauthorized phishing post appeared on COLDCARD's official X account and was deleted. COLDCARD warned on X not to visit or interact with the link, said its only official website is coldcard.com, and asked X to investigate. Never "migrate" funds through a link in a post.
• Mk2/Mk3: final firmware 4.2.0; not recommended for new use.
• Source: Coinkite advisory
• Source: COLDCARD security status
• Source: COLDCARD migration
• Source: COLDCARD downloads
• Source: Galaxy Research (Oct 16, 2026)
• Source: Galaxy Research (Aug 14, 2026)
• Source: Cointelegraph (Aug 25, 2026)
• Source: BlockSec analysis
• Source: Cointelegraph: X phishing post (Oct 11, 2026)
• Source: COLDCARD on X (@COLDCARDwallet)

Key features

• Bitcoin-only (coldcard.com).
• Air-gapped signing with microSD; NFC and QR on some models (coldcard.com).
• Dual secure elements (coldcard.com FAQ).
• Multisig with desktop coordinators (coldcard.com tutorials).

Read the current status below before using a COLDCARD. Seeds made on affected firmware must be replaced, and updating firmware does not fix them.

Buying and setup

Every brand: Buy only from the maker's own official store. Even listed or authorized resellers have been compromised. In October 2026, implanted Ledger devices that captured recovery phrases during setup were sold through CryptoBilis, a reseller Ledger's own site listed as authorized for Indonesia, Malaysia and the Philippines (Galaxy Research). Never restore an existing seed onto a device you didn't buy direct from the maker. Treat any device that arrives already set up, or with a printed or pre-filled seed, as compromised. Don't use it.

• Buy only from the maker's own official store (coldcard.com), not from resellers, even ones it lists as authorized. Never use a device that arrives with a seed already written down.
• Set it up with our hardware wallet module, then pair it with Sparrow as a watch-only wallet.