I may be deleting this post in short order if the stackers point out that it has a lot of flaws because I don't want to confuse anybody, but I don't think there's really any good, short guide out there right now for what exposed users can do next. So here's what I would do if I had used a Coldcard to generate keys in the last five years. Feel free to add your two sats below. Alternatively, post a link to such guides as may already exist.
Do you need to freak out?
- this problem only affects Coldcard users.
- if you used a Coldcard to generate your seeds/keys between 2021 and now (july 2026), it is likely that the keys are vulnerable to brute-forcing.
- this applies if you used an Mk3, Mk4, Mk5 or Q. (Mk2s are not affected)
- you should move your coins to a new wallet, with newly generated keys.
- only use your Coldcard to generate these new keys if you have applied the patches released today.
- patching the device alone does not fix your existing seeds/keys
- you must sweep your existing wallet to a new one.
What to do instead of freaking out:
- if you used a Coldcard to generate your seeds/keys, move your coins to a new TEMPORARY wallet.
- start by picking something easy to do: factory reset an old phone or wipe an old laptop and install ubuntu (it's easier than you think).
- update the device
- if it's a phone, download blue wallet
- if it's a laptop, download Bitcoin Core
- create a new wallet.
- write down your seed words (if using mobile) or save your wallet.dat file on a USB (if using Bitcoin Core)
- send a small amount of bitcoin into this new wallet
- delete the wallet
- restore the wallet on the same device
- check balance to see if it is what you sent to your wallet
- send wallet balance back to an address from your old wallet
- sweep all funds from your Coldcard Wallet to your fresh new wallet
- come up with a better long term plan: buy a new hardware signer, learn how to create a multisig.
#1538946
Dice Rolls:
To clarify:
Most common question i'm seeing is people want to know if they're OK if they used dice rolls with the Coldcard. Yes, dice rolls side-stepped the issue. Don't panik.
Not sure this is good advice yet for most. It moves the balance away from theft, but moves it toward loss, because storage is an unsolved problem for most. Paper and volatile disk storage are weak links, plates are high friction.
People need to understand the trade-offs of multisig before listening to people that are just bleating it out. Those same people often bleated Coldcard too.
Yes. You get a new operational reality when you use multisig. You take away one worry and replace it with a bunch of others. Some easier to harden, but not all.
I'd suggest that the conditions under which to use multisig and under which not to are very important and if I'm honest, it's really hard to define the point in which it flips from "don't" to "do". Technical confidence is also pretty tough to self-assess in the first place (especially whether it is overconfidence or not.)
I am willing to admit that I don't have the same amount of technical knowledge as many, but I really do sleep good at night because I have keys stored with people I trust in other geographies and jurisdictions. I have the luxury of being able to trust these people to hold a key. But if it's something like 3 of 5, I don't have to trust them so very much (mostly just not to lose the key or spy on my descriptor).
I agree that multisig is not for every circumstance, but j do feel comfortable telling people I know that if they are going to have more than 1btc, they need more than 1 key.
That sounds better than someone trying to manage 3 keys themselves across disparate devices and having to back up each, esp where I assume you'd have descriptors with each of your people as well
This is one direction my brain wanders into solving this issue, there's already a few paid services for this collaborative custody model and it replicates how enterprises deal with similar challenges. I even remember reading a Bitmex post from a hundred years ago about their withdrawal system needing multiple executives to approve.
Collaborative Cold Storage.
https://m.stacker.news/150385
This opens the design space quite a bit too. Imagine we humble stackers holding keys for one another.
There's other issues to mitigate, but it's worth exploring deeper how to standardize this.
Why this step " * send wallet balance back to an address from your old wallet"?
I will never send serious funds to a wallet I havent made a test spend from. Gotta make sure your keys actually work.
Edit: never mind. "test spend from" I'm a retard.
I suppose I could sign a message, but to my dumb mind, the best way to ensure that I can send out of the wallet is to spend out of the wallet (I guess you don't need to spend the whole utxo, but why make change if you don't have to?)
never sign a message. 1 key 1 use(case).
Is there a better maintained tutorial than this?
Its a pretty good guide. And I'm sure it would benefit from any attention you give it.
I'm also partial to JWWeatherman's Yeti Cold stuff as well as Ben Westgate's Bails concepts. Neither is perfect, but they show you a different way of thinking about Bitcoin security.
I think that that tutorial is a great starting point - just needs updates and maybe some more vetting where it talks about 3rd party stuff. It's MIT-licensed so anyone can pick this up. I'd just fork the repo and start editing, talk to Mike if you feel like this is something worth your time and want to move it further. The main thing here is testing.
I can pledge you a few h/week of my time for review or 3rd party code assessment if you wanna do something like that.
It seems like a worthwhile pursuit. I'll see what I can do.
Thank you for this, I think it is valuable. It's basically what I did last night, but had to piece the steps together while remaining calm
Just reading this while on vacation. I don’t have my CC with me. I unfortunately have an MK4. No dice rolls. No pass phrase. I do have a way to get my seed phrase. I’m moderately panicking right now. Not sure what to do right now. I have spot checked a few receiving addresses and they are fine but don’t want to risk waiting until I get back home.
Depending on the risk level of how you set it up it may warrant going to a store and grabbing a cheap computer, slap a fresh upstream linux on it, and recover from seed to something like Electrum until you can re-evaluate.
Just learn how to build your own cold storage.
Its so easy even I can do it.
If I can do it so can you.
https://electrum.readthedocs.io/en/latest/coldstorage.html
But @DarthCoin said Coldcard is good.