Coldcard Wallet Security Alert: Move Your Bitcoin Now

If you store Bitcoin on a Coldcard hardware wallet, you may need to act right now. A serious security flaw has been discovered, and hackers are already using it to steal people's money.

First, some basics. A hardware wallet is a physical device (like a small USB stick) that stores the secret keys to your Bitcoin offline, so hackers can't reach them over the internet. The Coldcard is one popular brand. A seed phrase (or word seed) is a list of secret words that acts like the master password to your crypto — anyone who has it can steal all your coins.

Here's the problem: Coldcard models MK3, MK4, MK5, and Q had a bug in how they created these seed phrases. The device didn't use enough true randomness (called entropy), which means attackers can guess the secret words and drain the wallet — without you clicking anything.

Key facts:

• Affects seed phrases created after the end of 2020
• Around 1,000 BTC (worth tens of millions of dollars) has already been stolen
• Only wallets made using the dice roll method (rolling 50+ dice to add your own randomness) are safe

What you should do immediately:

• If you have another (non-Coldcard) hardware wallet: send your Bitcoin there right away.
• If Coldcard is your only device: create a temporary passphrase (an extra password made of at least 6 randomly chosen words) to buy yourself safety, then move funds.
• If unsure or uncomfortable: move funds to a software wallet app like Nunchuk, Blockstream Green, or BlueWallet.

The makers, Coinkite, have released a firmware patch (a software update that fixes the bug). Once updated, Coldcards are safe to use again with a newly generated seed.

Bottom line: Don't panic, but don't wait. Move your funds to safety, update your device, and warn any friends who own a Coldcard — many people may not even know they're at risk.

This is an AI-generated summary. Read the original article at: https://bitcoinmagazine.com/news/coldcard-security-risk-immediate-action-required