Coinkite has rolled out a major security firmware upgrade for its Coldcard hardware wallets, aiming to harden seed phrase generation against a class of failures that can leave private keys more guessable than they should be. The company says the updates—Coldcard firmware 5.6.1 for Mk4 and Mk5 and 1.5.1Q for the Coldcard Q—change how new wallet seeds are created by requiring user-supplied entropy and combining it with multiple onboard sources of randomness.

The move comes as confirmed losses from the Coldcard exploit continue to be tallied. According to an Aug. 14 report by Galaxy Research, confirmed theft reached 1,778 BTC (about $112 million). Galaxy’s reporting also places the incident among the year’s largest crypto hacks, with DefiLlama’s aggregated data ranking it as the third-largest exploit of 2026.

Key takeaways

• Coinkite’s firmware updates require new seed phrases to include user-supplied entropy collected through interactive user actions.
• Coinkite says the collected entropy is mixed with device randomness from secure elements and the hardware RNG to reduce the impact of any single randomness failure.
• Users are instructed to upgrade immediately, but must also replace existing seed phrases before migrating funds, because old seeds are still considered vulnerable.
• The update adds additional protections around USB data handling and transaction signing by re-verifying transactions immediately before signing.
• As the ecosystem responds to “weak seed” risks, Coinspect has launched a free tool intended to detect addresses generated from known weak seed phrase datasets.

User entropy becomes a required ingredient for new seeds

The most significant change in Coinkite’s release is in the mechanics of seed phrase generation. The firmware requires that newly generated seeds incorporate user-supplied entropy through at least 65 keypresses with deliberately unpredictable timing, plus one of two additional interaction-based inputs: 50 rolls of a six-sided die or 128 coin flips. The company pairs this user input with randomness sourced from multiple hardware components, including secure elements and the wallet’s hardware random-number generator (RNG).

Coinkite’s stated goal is straightforward: even if one entropy source fails or behaves unexpectedly, the seed creation process should still produce private keys that remain hard to predict. That “defense in depth” matters for users because seed phrases are the single critical root of control in Bitcoin self-custody—if their generation is weakened, an attacker may be able to brute-force likely keys rather than needing to break cryptography.

Importantly, Coinkite stresses that upgrading the firmware does not automatically immunize existing wallets. The company told users that previously generated seed phrases remain vulnerable after the update and must be replaced with new seeds before any funds are migrated. In practice, this means the security benefit applies to future seed creation, not past ones.

Seed protection continues after a prior fix

The Thursday release follows a broader security review and extends protections that were already introduced in a July 31 firmware update. Coinkite previously said that update addressed the seed-generation failure for wallets created after that point. The new 5.6.1 and 1.5.1Q releases build on that foundation by strengthening how entropy is gathered and validated, and by adding safeguards beyond seed generation alone.

Coinkite also characterizes the new approach as closing a theoretical gap involving a compromised computer USB port. Rather than assuming the external host is trustworthy—or assuming that checks performed earlier in a workflow are sufficient—the firmware is designed to re-verify transactions immediately before signing. This reduces the chance that altered transaction data could survive earlier checks and make it onto the signing path.

Additional enhancements include hardware RNG checks and a boot-time test intended to confirm that the wallet is using the intended hardware randomness path. Coinkite further restricts how USB transfers occur by limiting downloads to the device’s most recent output and requiring an encrypted session.

Finally, certain Bitcoin signature hash modes that can allow transaction outputs to be modified are now blocked by default, tightening the rules around which transaction forms the device will sign.

Coldcard losses remain material while upgrades roll out

Even as Coinkite issues new defenses, the fallout from the Coldcard exploit continues to be quantified. Galaxy Research’s Aug. 14 report, cited in the coverage of this firmware update, put confirmed losses at 1,778 BTC (about $112 million). The same reporting context notes the incident’s scale relative to other 2026 hacks, using DefiLlama’s aggregated exploit rankings.

For users, the critical implication is that remediation must be more than “patch and hope.” The requirement to generate new seed phrases underscores that the security model is tied to how a wallet was originally initialized. In other words, if a wallet was created under weaker randomness assumptions, the safest path is typically to replace the root of control rather than rely on later software fixes.

Given the confirmed-loss magnitude, these upgrades also carry practical urgency for anyone who used affected wallets and has not yet assessed whether their seed phrase was produced under the vulnerable conditions. The firmware update provides a clearer security story for new wallet initialization, but it does not undo exposure retroactively.

Software tools emerge to identify weak-seed exposure

Alongside firmware changes, the security ecosystem is increasingly focused on detection. Coinspect announced Unlukey, described as a free public tool for identifying wallet addresses generated from weak seed phrases. In a Friday post on X, Coinspect said the initial version aims to reproduce known weak seed generation behavior and then check whether public addresses fall into an affected dataset.

This kind of tooling matters because it moves the conversation from “what might be vulnerable” to “is this specific wallet address likely connected to weak-seed generation.” While such tools cannot replace operational security measures—such as upgrading, re-seeding, and moving funds—their role is to help users triage and focus on wallets most likely to be impacted.

The broader context for weak-seed risks includes claims from TRM Labs, which stated that a firmware bug from March 2021 weakened seed randomness on some Coldcard wallets. TRM Labs said this reduced key strength from 128 bits to 40 bits, making affected keys “brute-forceable without physical access.” Those figures are particularly relevant because they illustrate how far a randomness failure can go beyond a small quality-of-randomness issue—potentially changing the feasibility of an attacker’s search.

For builders and traders alike, the evolving response highlights a pattern seen across major wallet incidents: security upgrades address the technical causes going forward, while independent detection tools attempt to quantify exposure in the wild. Investors should watch how these tools perform in practice—especially whether they gain broader validation and whether they help more users act quickly and correctly.

Next, users running older Coldcard firmware should confirm they are using the latest releases and follow Coinkite’s guidance on re-seeding before moving funds, while the wider community will likely keep evaluating how detection tools like Unlukey map to real-world exposure. The remaining uncertainty is how comprehensively the weak-seed issue affected wallets in circulation—and whether further forensic work will refine estimates as additional data comes in.

Coinkite has released a major security upgrade for its Coldcard hardware wallets aimed at strengthening seed-phrase generation by forcing users to contribute unpredictable entropy. The change is designed to ensure private keys remain hard to predict even if one of the device’s randomness sources underperforms.

In a Thursday blog post, Coinkite announced firmware 5.6.1 for the Coldcard Mk4 and Mk5, and 1.5.1Q for the Coldcard Q. The company said affected users must upgrade immediately and—critically—replace any existing seed phrases before moving funds.

Key takeaways

• Coinkite’s new firmware changes how Coldcard generates seed phrases by mixing user-supplied entropy with multiple device randomness sources.
• For newly generated wallets, the firmware requires user input via at least 65 keypresses with unpredictable timing (or equivalent die/coin-rolling actions).
• Even after upgrading, previously generated seed phrases remain vulnerable and must be replaced with new seeds before migrating funds, Coinkite says.
• The update also adds safeguards around USB handling, transaction verification timing, hardware RNG checks, and boot-time integrity testing.
• Separately, Coinspect launched Unlukey, a free tool intended to help detect wallet addresses potentially linked to weak-seed generation.

Seed phrases now rely on more user unpredictability

At the center of Coinkite’s update is a shift in seed generation. According to the company, newly generated seeds must incorporate user-supplied entropy through interactive actions, including at least 65 keypresses with intentionally unpredictable timing. Coinkite also describes alternative entropy contribution methods: 50 rolls of a six-sided die or 128 coin flips.

That input is then combined with randomness from several parts of the device, including secure elements and the wallet’s hardware random-number generator (RNG). Coinkite frames the redesign as defense-in-depth: by requiring user entropy and mixing it with internal sources, the resulting private keys should remain unpredictable even if one device entropy source fails or is otherwise compromised.

Importantly, Coinkite’s guidance is not limited to upgrading. The company warns that existing seed phrases do not become safe just because the firmware is updated; users must generate new seeds and replace the wallet’s backing recovery phrase before migrating funds.

Coinkite adds transaction and USB safeguards

The new firmware follows an earlier July 31 update that Coinkite says already corrected the seed-generation failure for newly created wallets. In its Thursday announcement, Coinkite describes the latest release as the result of additional security review over the subsequent weeks, expanding protections beyond seed generation.

One element targets how transactions are processed when a Coldcard is connected to a potentially compromised computer. Coinkite says the firmware re-verifies transactions immediately before signing—an approach intended to counter a theoretical attack involving a compromised USB port. In other words, the device aims to confirm that what it signs is still what it expects, right up to the moment it produces a signature.

Coinkite also describes new hardware RNG checks and a boot-time test designed to confirm the wallet is using the intended hardware pathway. Beyond randomness integrity, the update restricts USB downloads to the device’s most recent output and requires an encrypted session, reducing opportunities for manipulated data to be fed to the wallet during the workflow.

Finally, the firmware blocks certain Bitcoin signature hash modes by default—specifically those that could allow transaction outputs to remain modifiable under the affected conditions Coinkite references.

Impact from the Coldcard exploit remains significant

While Coinkite focuses on preventing additional exposure, the ongoing consequences of the Coldcard exploit continue to shape the security landscape. Galaxy Research reported that confirmed losses associated with the exploit reached 1,778 Bitcoin, worth about $112 million, in an Aug. 14 report. Galaxy’s assessment is linked to a broader figure compilation, and DefiLlama data aggregated in the same context ranks the Coldcard hack as the third-largest cryptocurrency exploit of 2026.

These figures underline why seed-generation hardening and secure transaction flows matter to users: even hardware-wallet protections can be undermined if randomness used for key material is weak or if signing operations can be influenced through connectivity or timing issues.

Weak-seed detection tools enter the ecosystem

Alongside firmware fixes, at least one blockchain security firm is working on software approaches to identify potential victims of weak seed generation. Coinspect revealed Unlukey, a free public tool for identifying wallet addresses that may have been generated from weak seed phrases.

In a Friday X post, Coinspect said the first iteration of Unlukey focuses on reproducing known weak seed generation patterns and checking whether public addresses appear in the affected dataset. While this does not automatically prove that any given address belongs to an exposed wallet, the tool is positioned as a way to narrow down exposure for individuals and analysts who are investigating risks related to the Coldcard incident.

Context on the underlying weakness comes from TRM Labs, which said in an analysis that a firmware bug from March 2021 weakened seed randomness on some Coldcard wallets. TRM Labs reported that the issue reduced key strength from 128 bits to 40 bits, making keys “brute-forceable without physical access.”

Coinspect’s decision to build an address-level detection method suggests the broader industry takeaway from the Coldcard episode: even when hardware vendors issue patches, secondary tooling can help the ecosystem identify which wallet outputs and addresses may be most at risk based on how seed generation was implemented in the past.

Readers should watch how users apply Coinkite’s guidance—especially the requirement to replace existing seed phrases before moving funds—and whether address-detection tools like Unlukey continue to expand coverage as more information about weak-seed generation patterns is validated.

A Reuters survey found that 63% of respondents believe President Trump and his family profiting from crypto is inappropriate, while 32% believed it was appropriate. Breaking down the respondents further, 69% of Republicans considered the profits appropriate, while an overwhelming 92% of Democrats believed they were inappropriate.

Survey Results

The nationwide survey was conducted between August 14 and August 17 by Reuters and Ipsos, and interviewed 1,166 adults. The survey has a margin of error of around three percentage points. The survey reignited the ethical debate around President Trump and his family’s crypto investments while he is in office. Understandably, views were divided by political leanings, as Republican supporters found the earnings appropriate, while Democratic Party supporters called them inappropriate.

“New Reuters/Ipsos poll: 69% of Americans, including 48% of Trump’s own voters, say his business interests are influencing his presidential decisions. His crypto ventures alone pulled in $1.4B last year.”

The poll also asked respondents about President Trump’s private commercial interests and found that 69% believed the president’s business interests have influenced his decisions. The survey only gauges public opinion about President Trump’s business interests and does not state or establish whether he violated laws or influenced government policy. The White House has also consistently rejected allegations of a conflict of interest. White House spokesperson Anna Kelly stated:

“There are no conflicts of interest. The President only acts in the best interests of the American public.”

Over $1.4 Billion in Crypto Income

President Trump’s annual financial disclosure was published in June. An analysis by Reuters revealed President Trump reported over $1.4 billion in income tied to cryptocurrency ventures in 2025. However, the figure is the reported income, not the current value of President Trump’s cryptocurrency holdings. According to a report by crypto.news, the disclosure included over $1 billion in crypto-related income, including World Liberty Financial and the Trump memecoin.

Trump-family linked companies have received nearly $800 million from World Liberty Financial, including over $520 million linked to token sales and over $250 million linked to the sale of various business interests. President Trump also reported $635 million from licensing agreements linked to the TRUMP token. The revenue went through several companies, and some of the proceeds were distributed among Trump family members and business partners.

Ethical Debate Rages On

The survey comes as lawmakers remain divided over whether crypto legislation should restrict officials and their families from investing in crypto-related businesses. The ethics provisions have become a significant stumbling block during negotiations to advance crypto legislation through Congress. Adding to the debate is the conditional approval given to World Liberty Financial to establish the World Liberty Trust Company as a national trust bank. Congressional scrutiny and conditions for the proposed trust bank will be a significant test of the separation of President Trump’s duties as President of the USA and family business interests.

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Yesterday, an influencer pretended to suffer a $6 million short liquidation on bitcoin (BTC) to attract followers and clout. The stunt fizzled after some basic fact-checking.

Crypto trader Laanie posted fake evidence of a leveraged wipeout long enough to attract a few hundred thousand views, then deleted the claim a few hours later.

The engagement farmer then hosted a social audio space on X to discuss the non-existent trade, which attracted over a thousand attendees amidst a particularly bullish day for crypto markets.

Indeed, BTC was enjoying one of its steepest, single day gains of the year, rallying from $64,000 to $75,000 in under 24 hours.

A proposed Community Note on X challenged the $6 million loss. It explained that the trading display Laanie shared had Bybit’s Demo mode enabled, a subtle yet unmistakable label for the crypto exchange’s simulated trading view.

Cointelegraph is committed to providing independent, high-quality journalism across the crypto, blockchain, AI, and fintech industries.

All news, reviews, and analyses are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy.