Coldcard has released new firmware to enhance security, requiring affected users to regenerate their mnemonic phrases and migrate their assets.

Coldcard Releases New Firmware Versions 5.6.1 (Mk4/Mk5) and 1.5.1Q (Q) The update comes after three weeks of ongoing security reviews following the July 31 emergency fix, with a focus on addressing security risks from prior mnemonic phrase generation attacks. The company said every newly generated mnemonic phrase will now require at least one user entropy source—including a minimum of 65 irregular key presses, 50 physical dice rolls, or 128 physical coin flips—combining user input with fresh entropy from STM32 TRNG, SE1, and SE2. Beyond strengthening the mnemonic generation mechanism, the new firmware adds real-time staged PSBT verification before signing, enhances USB connectivity and firmware update boundaries, improves Delta Mode isolation, fixes active wallet backup issues, strengthens random number generator initialization and fault checks, adjusts default SIGHASH settings, and includes multiple security and correctness improvements. Coldcard noted the update aims to further reduce the device’s attack risk. A critical warning: updating firmware cannot repair existing mnemonics generated by affected firmware. If a user’s mnemonic falls under this security advisory, they should first update their device, then generate and verify a new mnemonic, and migrate funds to the new wallet. Coldcard strongly urges all Mk4, Mk5, and Q users to update their devices promptly and verify the signature of the downloaded firmware.