Coldcard Releases New Firmware to Enhance Security; Affected Users Need to Regenerate Their Mnemonic and Migrate Their Assets

BlockBeats News, August 20, Coldcard released the latest firmware 5.6.1 (Mk4/Mk5) and 1.5.1Q (Q). This update was launched after a three-week security review following an emergency fix on July 31, focusing on the security risks posed by a previous mnemonic generation attack. The official announcement stated that each newly generated mnemonic must now incorporate at least one type of user entropy, including irregular key presses at least 65 times, physical dice rolls 50 times, or physical coin flips 128 times, and combine user input with fresh entropy provided by STM32 TRNG, SE1, and SE2.

In addition to strengthening the mnemonic generation mechanism, the new firmware also added pre-signature on-the-fly incremental PSBT verification, enhanced USB connection and firmware update boundaries, improved Delta Mode isolation mechanisms, fixed active wallet backup issues, further enhanced random number generator initialization and failure checks, adjusted SIGHASH default settings, and included multiple security and correctness improvements. Coldcard stated that this update aims to further reduce the risk of device compromise.

The official reminder is that updating the firmware cannot repair existing mnemonics generated by previously affected firmware. If a user's mnemonic is within the scope of this security advisory, they should update their device first, then generate and verify an entirely new mnemonic and migrate funds to a new wallet. Coldcard strongly advises all Mk4, Mk5, and Q users to promptly update their devices and verify the signature of the downloaded firmware.