Coinkite Coldcard Bug Forces Dice-Roll Entropy Fix as Multi-Vendor Multisig Becomes Baseline

Coinkite issued a mandatory firmware update for Coldcard Mk4 and Q devices this week that forces users to roll physical dice and press device buttons to seed new wallets, replacing the previous automated entropy source after a vulnerability disclosed in July and exploited in August 2026. The flaw resided in the deterministic random-number generator used during initial seed creation on single-signature Coldcard configurations. Attackers who extracted partial entropy data could reconstruct the seed and sweep funds. Multi-vendor multisig setups, combining a Coldcard with a Ledger and a Trezor, for example, were unaffected because each device contributes independent entropy. Bitcoin traded at $78,673 at 14:00 UTC on August 26, up 14.1% over the prior seven days, per CoinGecko. The price move coincided with renewed institutional inflows into spot ETFs, not the Coldcard disclosure.

### The vulnerability window Independent researchers identified the RNG weakness in early July. Coinkite confirmed the issue privately, developed the fix, and coordinated disclosure for early August. Two confirmed exploits occurred between July 28 and August 3 before the patch shipped; neither resulted in customer loss because the targeted wallets held testnet coins. ### Why multi-vendor multisig survived A three-device multisig quorum requires signatures from three independent hardware roots of trust. Even if one device’s entropy is compromised, the attacker lacks the other two key shares. Single-sig Coldcard users had no such redundancy. ### New baseline for self-custody Security teams at Unchained, Casa, and Nunchuk now recommend heterogeneous multisig as the default for balances above 1 BTC. Coinkite’s fix restores single-sig safety for new seeds, but existing seeds generated before the patch cannot be retroactively hardened, they must be swept to new multisig wallets. ### Watchpoint Monitor Coldcard firmware adoption rates via the device’s signed attestation endpoint. CoinGecko data shows a lag below 90% on Mk4/Q within 30 days would signal residual risk in the wild.