Coldcard’s firmware 5.6.1 changes how new seeds are created, requiring user entropy in the standard flow while also tightening several other security-sensitive parts of the wallet.
- 5.6.1 is a recommended standard release for Coldcard Mk4/Mk5.
- New seed creation now combines device entropy with user input in the standard workflow.
- Updating firmware does not repair an already affected seed; migration may still be needed.
- The “$100M exploit” reference is not verified in the available materials.
For Bitcoin self-custody, that first point is the one that matters. A hardware wallet can be elegant, rugged, and open-source-friendly, but if the seed generation process is weak, the rest of the setup is built on sand. Once the seed is compromised, the wallet is not “mostly secure.” It is just a nicer-looking way to lose money.
Coldcard’s security guidance says standard new-seed generation on Mk4/Mk5 5.6.1 now uses fresh device entropy plus a required user method. The accepted user inputs are at least 65 key presses with unpredictable timing, 50 physical six-sided-die rolls, or 128 physical coin flips. That applies to the standard new-seed flow, not every possible seed-generation path.
Entropy is just randomness. In plain English, the more unpredictable the seed creation process, the harder it is to guess, reproduce, or attack. In Bitcoin terms, the seed is the root secret that controls the wallet’s keys, while the seed phrase is the human-readable backup words derived from it. A BIP-39 passphrase is a separate extra secret layered on top. These are not interchangeable, and mixing them up is how people end up learning expensive lessons.
Coldcard’s own documentation makes a key point that should not be buried: updating firmware does not fix an already affected seed. If a seed may have been created under weaker conditions, the real fix is to move funds to a newly generated wallet under the updated process. Firmware updates help future security. They do not perform miracles on old secrets.
The update is also broader than seed generation. Coldcard’s security status page lists changes around RNG fault handling, PSBT checks, USB upload handling, message-signing restrictions, and Delta Mode isolation. That suggests a wider hardening effort, not just a single patch slapped onto one problem and called a day.
PSBT stands for Partially Signed Bitcoin Transaction. It is a Bitcoin standard used to move transactions between devices in a controlled way, especially in multisig and hardware-wallet workflows. If a wallet mishandles PSBT boundaries or staged data, that can open the door to bad inputs, parsing bugs, or signing mistakes. Coldcard says 5.6.1 adds extra verification and rejects oversized staged PSBTs, which is the sort of unglamorous security work that matters more than shiny marketing ever will.
Coldcard also says the release includes changes in Delta Mode, a special operating mode meant to limit what the device can reveal or access. According to the security notes, the update wipes seed data in some Delta Mode paths rather than exposing saved passphrases, blocks certain vault and restore actions, wipes seed before BIP-85 derivation in Delta Mode, and prevents valid message signatures when using a Delta Mode PIN. BIP-85, for readers who have not spent time in wallet nerd territory, is a standard for deriving additional secrets from a master seed. In the wrong hands, that is a lot of power. In the right hands, it is useful. Security always has a way of being both.
Coldcard’s documentation also draws a sharp line around dice-only generation. In that advanced workflow, the device explicitly warns that no hardware entropy is included. That is not a contradiction; it is a separate path with different assumptions. The important part is that the standard seed flow now leans on both device randomness and a required human contribution, which is a more conservative way to generate a root secret.
The title’s reference to a $100M exploit should be treated carefully. The materials available here confirm that Coldcard released a remediation and broader hardening, but they do not verify a specific $100M incident tied directly to Coldcard. It may refer to an ecosystem event, a different compromise, or simply a dramatic shorthand attached to a real technical issue. What is confirmed is the fix, not the headline’s implied origin story.
That distinction matters because crypto loves a big scary number almost as much as it loves pretending every bug is a civilization-ending hack. Sometimes the threat is real and obvious. Sometimes the framing is lazy. If the exploit was not directly against Coldcard, calling the device “hacked” would be misleading. A more accurate read is that Coldcard responded to a seed-generation problem and hardened several other attack surfaces at the same time.
Coldcard says some independent validation supported parts of the remediation, including hardware RNG behavior and the removal of fallback paths that were not wanted. That is helpful, but it is not a blanket guarantee and not a full audit. It raises confidence in specific changes. It does not grant immunity from every possible defect under the sun.
For users, the practical checklist is straightforward: verify the signed firmware download, update if you use an affected model, and check whether your seed was created under the older process. If it was, follow the migration guidance rather than assuming a firmware install cleans up the problem. If you hold meaningful amounts, a strong and unique BIP-39 passphrase can add another layer of defense, but only if you back it up properly and test recovery before you need it in anger.
Key takeaways
-
What changed in firmware 5.6.1?
Coldcard says the standard new-seed flow now combines device entropy with required user input, and the release also includes broader security hardening. -
Does updating fix an old vulnerable seed?
No. Coldcard says updating firmware does not repair an existing affected seed, so migration may still be necessary. -
Is the $100M exploit confirmed here?
No. The available material does not verify that figure as a specific Coldcard-linked exploit, so it should be treated cautiously. -
Why does entropy matter so much?
Because the seed is the root secret of a Bitcoin wallet. Better randomness makes that secret much harder to predict or attack. -
Should current Coldcard users do anything now?
Yes. Verify signed firmware, update if needed, check whether any seed was created under the older process, and migrate funds if there is any doubt.
The bigger lesson is simple: self-custody is only as strong as the weakest step in the setup. Entropy, verification, backups, migration, and passphrase handling all matter. In Bitcoin security, “close enough” is just another word for “eventually expensive.”
Further reading
A few related pieces on Coldcard, wallet security, and the broader self-custody picture.
