Performances
RD Popularity Index
RD Growth Index
Comparison
Team
Follow Updates
Follow Lists
People
About Coldcard
Coldcard is a Bitcoin-only hardware wallet that focuses on offline transaction signing. Its core business is providing physical devices that keep private keys completely isolated from internet-connected computers. The main value proposition is security through physical isolation, dual secure elements from different manufacturers, and open-source firmware that users can verify. It solves the market pain point of protecting large Bitcoin holdings from remote hackers and compromised computers, as transactions are signed on-device and transferred via SD card, NFC, or QR codes.
In the past six months, the company faced a critical vulnerability discovered in July 2026. The flaw affected firmware versions 4.0.1 to 4.1.9, where the random number generator used for creating seed phrases was replaced with a software-based pseudo-random generator using publicly known constants. This reduced the effective entropy of generated seeds to only 40-72 bits instead of the intended 128 bits, making them brute-forceable. An attacker exploited this to steal approximately 1,816 BTC from over 5,200 addresses within hours. The company released patched firmware on July 31, but existing weak seeds could not be fixed by updates. Affected users were advised to generate new seeds on updated devices and transfer funds. The company did not announce a compensation plan and faced potential legal action. This incident severely damaged its reputation as a security-first wallet.
Coldcard, a Bitcoin hardware wallet by Canada's Coinkite, launched in 2017, gained trust for its Bitcoin-only design, dual secure chips, and open-source firmware. A critical turning point occurred in March 2021 when a firmware update (v4.0.1) inadvertently switched mnemonic generation from hardware RNG to a software PRNG with hardcoded constants, reducing entropy to ~40 bits on Mk2/Mk3 and 72 bits on Mk4/Mk5/Q. This flaw remained undetected for over five years. On July 30, 2026, attackers began exploiting it, ultimately draining 1,816 BTC ($116 million) from 5,200+ addresses across four waves. Coinkite responded by releasing patched firmware (v4.2.0), destroying affected inventory, and urging users to regenerate seeds and migrate funds. The incident highlighted that even cold wallets face software-layer risks, making it a landmark case in Bitcoin self-custody security. Coinkite also suspended automatic customer data deletion to aid investigations.
Over the past six months, Coldcard experienced a critical security incident. In early August 2026, a firmware build flag from March 2021 disabled the dedicated randomness chip, leading to weak seeds. An attacker brute-forced these seeds, draining 1,816 BTC from over 5,200 addresses in 41 minutes across four waves. Coinkite released emergency firmware (5.6.1 for Mk4/Mk5, 1.5.1Q for Q) on August 20, 2026, which now mandates user-added entropy during seed generation and adds pre-signing transaction checks (e.g., PSBT checksum verification, blocking SIGHASH_SINGLE). However, the update does not fix already compromised seeds; users must migrate funds to a newly generated wallet on a second device. Official future focus includes strengthening entropy generation, enhancing transfer security, and completing a formal post-mortem. Coinkite advises affected users to move funds immediately and emphasizes that passphrases do not mitigate the flaw.
Coinkite, the company behind Coldcard, was co-founded by Peter Gray (CTO) and Rodolfo Novak (CEO, known as NVK).
Peter Gray: Co-founder and CTO. A veteran embedded systems engineer with 30+ years of experience. He led development of Coldcard firmware and hardware, and previously founded Digital Multitools Inc., creating KVM-over-IP products. He holds multiple patents in USB and embedded systems.
Rodolfo Novak: Co-founder and CEO. He drives product strategy and business development. Under his leadership, Coinkite has shipped Coldcard, a leading Bitcoin hardware wallet, and other security tools. He is active in the Bitcoin community and advocates for self-custody.