Coldcard Rolls Out Firmware 5.6.1 Requiring User-Supplied Entropy After $100M+ Bitcoin Theft Reportedly Linked to Seed Weakness

Coinkite has released firmware version 5.6.1 for its Coldcard Bitcoin hardware wallet, introducing a major change to how new recovery seeds are created. Under the update, users must provide their own entropy (randomness) each time they generate a new seed on the device, rather than relying mainly on the wallet's internal random number generator as in prior versions. The move follows industry reports of a seed-generation vulnerability associated with a large Bitcoin theft. CryptoPotato estimated losses at about $100 million, while The Cryptonomist EN reported $112 million. Both figures refer to the same incident, though reporting has not converged on an exact total. Seed phrases—commonly 12 or 24 words—are the basis of self-custody security because they encode the private keys that control a user's funds. If the randomness used to generate a seed is weak, predictable, or compromised, attackers could theoretically reconstruct the keys and empty the wallet. Security researchers have long recommended adding user-supplied entropy as a mitigation. Typical sources include dice rolls, camera-captured images, or other manual methods. This user input is combined with the device's internal randomness rather than replacing it, reducing dependence on any single entropy source that could be degraded by a firmware bug or a supply-chain issue. Hardware wallets are promoted as safer than exchange custody because private keys are intended to remain on-device. That security claim depends heavily on the integrity of the random number generation process during setup; weaknesses at seed creation can undermine cold storage even if keys are well protected afterward. While exchange hacks and smart contract exploits more frequently dominate headlines, vulnerabilities in hardware wallets or key-generation workflows can be especially dangerous because they may expose funds without obvious signs. Users who created seeds on earlier firmware may want to review Coinkite's official guidance on whether migrating to newly generated seeds is advisable. Coinkite has not been directly quoted in the reporting on the specific technical root cause. The requirement for user-provided entropy, though, indicates the company considered the prior process insufficient on its own and framed the change as a response to the reported exploit. Market impact appears most immediate for Coldcard users and the broader self-custody hardware wallet segment. The renewed attention on seed-generation practices may prompt other wallet makers to reassess or strengthen their entropy implementations. No pricing or trading data has been linked to the event in available coverage, leaving any broader market reaction unconfirmed. Coldcard users are advised to update to firmware 5.6.1 and consult Coinkite's official recommendations for seed handling going forward. FAQ What is Coldcard? Coldcard is a Coinkite hardware wallet designed for offline storage of Bitcoin private keys for self-custody. What does 'user entropy' mean here? It refers to randomness the user contributes manually—such as dice rolls or camera input—which is combined with the device's internal randomness when generating a new seed. How much Bitcoin was reportedly stolen? Coverage varies: CryptoPotato cited roughly $100 million, while The Cryptonomist EN cited $112 million, referring to the same underlying incident. Should existing Coldcard users do anything? Users who generated seeds before the update may want to review Coinkite's official guidance to determine whether regenerating and migrating to a new seed is recommended. Originally reported by AltcoinGordon; written by Grace Mitchell. Republished with permission. View the original on AltcoinGordon.