All Coldcards At Risk
Mk4 and Q are now also considered at risk if you relied on device-generated entropy.
If you have not read the earlier Coldcard alert, start there: ALERT: Coinkite Coldcard Security Advisory.
It now looks like this:
- If you are using any Coldcard, and
- You did not use 50 to 100 dice rolls for entropy when generating your seed phrase,
Your funds are at risk and should be moved immediately.
This now includes the original Mk2 and Mk3 issue as well as Mk4 and Q series devices, which also appear to be at risk, although they may require more computational power to crack.
Coinkite has issued instructions for generating a new seed phrase with entropy on the device: read Coinkite’s updated guidance. If you have no better option, that may buy some time while you migrate. Be careful.
Other options include those laid out in the earlier alert. At this point, even moving temporarily to a hot wallet or depositing to an exchange is better than getting drained.
If you did use at least 50 dice rolls for external entropy, the current thinking is that you should be okay, although many users are likely to move off Coldcard anyway.
More on the long-term implications should follow in the next letter.
mark
