COLDCARD Users: Move Your Bitcoin Today

Coinkite has disclosed a flaw in how its ColdCard devices generated seed phrases. The hardware random number generator was bypassed, and seeds were produced with far less randomness than intended.

That means someone who has never met you, never touched your device, and never seen it connected to the internet can work out your keys. Over 1,000 bitcoins have already been swept from hundreds of wallets, and funds are still moving.

I recorded an emergency episode with Rob Hamilton, co-founder and CEO of AnchorWatch, who was among the first to analyze the sweep on-chain. He explains the whole thing in plain language in about twenty minutes.

Please watch it before you do anything else.

Who is immediately affected

• Mk2 and Mk3 on firmware 4.0.0 through 5.0.3 — confirmed exploited

• Mk4 and Mk5 on firmware before 5.6.0

• Q on firmware before 1.5.0Q

Two things people are getting wrong. First, if you generated your seed on a ColdCard and later moved it onto a Ledger, Jade, Trezor, or anything else, you are still at risk. The flaw is in the seed itself, not the device holding it. Second, multisig does not automatically save you — if two of your three keys came from affected ColdCards, your quorum is compromised.

Your risk is meaningfully lower, though not zero, if you used a BIP-39 passphrase that never touched a computer or a phone, or if you added 50 or more of your own dice rolls at setup.

What to do if you’re moving to another self-custody wallet

1. Generate a new seed on an unaffected device.

2. Send a small test transaction first.

3. Then move the rest.

If you aren’t technical and this feels like too much tonight, sending funds back to an exchange you’ve used before is a better position than sitting on a compromised seed. You can build a proper self-custody setup once the panic has passed.

Slow is smooth, and smooth is fast. The worst outcome this weekend would be someone losing their savings to a rushed mistake rather than to the flaw itself.

The team at The Bitcoin Way is also standing by to guide you through this 1-on-1. Visit www.thebitcoinway.com/natalie to schedule a free phone consultation.

One warning

Do not enter your seed phrase into any website offering to check whether you’re affected. No legitimate tool works that way. Every one of them is a thief taking advantage of a frightening night.

Please forward this

Coinkite doesn’t retain customer records. That was a real privacy decision on their part, and it also means they have no way to email the people affected. Word of mouth is the only distribution this story has.

If you know someone who owns a ColdCard, send them this email or the video. That’s the whole ask.

Coinkite’s technical advisory: blog.coinkite.com/entropy-technical-backgrounder/
Rob is on X at @rob1ham, and his DMs are open.

— Natalie

Stay Up-to-Date Each Week With The News Block

And if you’re not already subscribed to The News Block — every week we break down the biggest stories in Bitcoin and macro in a way that’s fast, honest, and actually useful. New episodes drop every Monday in your inbox and wherever you listen to podcasts. Subscribe at thenewsblock.substack.com so you never miss a beat.

These are the companies that power Coin Stories — and you’ll see why I use them myself!

🏦 Borrow against your Bitcoin without selling it Ledn — Ledn has a perfect track record protecting over $11 billion in client value through every market cycle since 2018. Tokenized gold is now live on Ledn, giving you two of the most verifiably scarce, non-sovereign assets ever created, held side by side. Hard assets. Real flexibility. One platform. Get 0.25% off your first loan. → ledn.io/natalie

⚡ Send Bitcoin instantly over Lightning Speed Wallet — Send, receive, or swap stablecoins and digital gold into Bitcoin in one app. Run a business? Speed powers Bitcoin payments for Steak ‘n Shake, and it can do the same for you. Code COINSTORIES10 for 5,000 free sats after your first transaction. → speed.app/natalie

⛏️ Fully-managed Bitcoin mining in the U.S with Abundant Mines — You own the miners. You keep 100% of the Bitcoin. Voted #1 mining company by peers. Get 1 month of free hosting → abundantmines.com/Natalie · Watch my episode with the founders

🔐 Self-custody your Bitcoin safely Bitkey by Block — Download Bitkey today and use my promo code STORIES to get 10% off the new Bitkey. Code STORIES for 10% off. → Bitkey.world/STORIES

🧠 Get 1-on-1 help setting up self-custody The Bitcoin Way — Personal guidance to master your own keys and sleep soundly at night. → thebitcoinway.com/natalie

🏛️ Hold Bitcoin in a tax-advantaged retirement account BitcoinIRA — Buy Bitcoin 24/7 inside a Traditional or Roth IRA. → bitcoinira.com/natalie

Efani — The most secure mobile service in America. Protects against SIM swaps. Trusted by CEOs and VIPs. → efani.com/natalie

CrowdHealth — I ditched fiat health insurance four years ago and joined CrowdHealth. I never spend more than $200 on health coverage through my CrowdHealth plan. Get started with a discounted plan at my link. → joincrowdhealth.com/natalie

Thanks for subscribing, and if this newsletter resonated, forward it to one person who needs to read it.

— Natalie

Disclaimer: This newsletter is for informational and entertainment purposes only and should not be considered financial, investment, or legal advice. I am not a financial advisor. Always do your own research before making any investment decisions. Information and opinions shared here may change without notice. Some links in this newsletter are affiliate or sponsor links, which means I may earn a commission at no additional cost to you.