Hardware wallet manufacturer Coldcard has issued a new high-priority security warning, stating that the cryptographic threat affecting its users is far from over. The company advises all users to transfer their bitcoins to new wallets and generate entirely new recovery seed phrases.
According to Coldcard, the risk persists due to a vulnerability in the security system affecting the key generation process, which has led to losses of approximately $40 million. Users are recommended to update the firmware and discontinue using addresses generated with outdated generation methods to prevent unauthorized asset transfers.
The company also refuted claims that the current firmware has permanently rendered Coldcard devices unusable. Coldcard stated that in the case of a temporary True Random Number Generator (TRNG) error, disconnecting and restarting the device from all power sources should resolve the issue under normal hardware conditions.
The statement published by Coldcard contained the following information:
"Claims that the latest software permanently renders Coldcard devices unusable are incorrect. In the event of a random number generator error, completely power off the device and restart it. The situation is temporary; data will not be written to flash memory, and the system is designed to shut down safely."
Developers also stated that there is no evidence that the current random number generator fix permanently disables the devices. They explained that if a temporary seed error in the random number generator occurs, fully powering off and restarting the device is expected to restore normal operation.
However, developers are working on a new patch that will make the process of recovering the random number generation system after an error safer. It is reported that the proposed update will follow the documented recovery procedure from chip manufacturer STMicroelectronics and include additional security measures, such as limited retry attempts, seed error detection, and deletion of old random number generation results after recovery.
It was announced that support for Coldcard Mk3 devices will be implemented in a separate software update.
*This is not investment advice.
