Coldcard: what it is and how to use it
Coldcard is a Bitcoin-only hardware wallet from Coinkite (Canada), used offline with an SD card. It matters for self-custody because the keys stay off your computer, but in 2026 it had a serious seed-generation flaw.
Overview
| Category | Hardware wallets |
|---|---|
| KYC required | to verify |
| Open source | to verify |
| Price | — |
| Official site | coldcard.com |
How do you use Coldcard?
- First, read the security notice on Coinkite's site, typed by hand rather than from a link you received.
- Buy only from the maker's official site; avoid marketplaces, unknown resellers and used devices.
- Check the packaging and reject any device that ships with a pre-filled seed or recovery card.
- Update to the fixed firmware and generate a fresh seed on the device, or with real dice rolls, following the official notice.
- Write the words by hand, numbered and in order, on paper; for the long term, engrave them in metal.
- Confirm the backup on the device, and never photograph the seed, type it into a website or store it in the cloud.
- Test recovery with a small amount and, if you like, connect it to a software wallet such as Sparrow to spend with coin control.
What are the limits and cautions?
- On 30 Jul 2026 Coinkite disclosed that the firmware used a weak pseudo-random generator when creating seeds (about 40 bits on Mk2/Mk3 and 72 bits on newer models, versus the 128 or more expected); attackers drained wallets.
- Updating the firmware does not repair a seed already created: the guidance is to treat a seed from an affected model as compromised (unless made with 50 fair, private dice rolls) and move to a new one. A passphrase does not solve it.
- Phishing that imitates Coldcard "security audits" has circulated; be wary of emails and messages on the subject.
Other Hardware wallets tools
How to Buy Bitcoin Anonymously — See the book on Amazon