Was my seed affected by the 2026 Coldcard flaw? A two-minute check

The rules in full

These are the same rules the check uses, taken from Coinkite's advisory, Coldcard's migration guide and Block's analysis. You can reach your answer from this section alone; it works without JavaScript.

Step 1. Where did the seed words come from?

Step 2. Which firmware did the Coldcard have when it created the words?

• Use the date if you don't know the version. Every fixed release came out on 31 July 2026 (release tags on GitHub). Every earlier Mk4, Q and Mk5 version had the bug (Block), so a seed those models created before that date is affected unless the dice exception in step 3 applies.
• Edge and standard are separate tracks. A higher Edge number does not by itself mean the fix is included (Coinkite).
• What counts is the firmware when the words were created. Updating later does not repair the seed (Coinkite).
• Still don't know the version, the date or even the model? Treat the seed as affected, unless the dice exception in step 3 applies.

Step 3. The dice exception

If the seed was created on affected firmware but you also entered dice rolls, it may still be safe from this issue. Coinkite's exception needs all four of these:

1. at least 50 fair, independent rolls of a six-sided die;
2. entered through the Add Dice Rolls option when the seed was created;
3. rolls that nobody else saw and that were never written down, photographed or saved;
4. you use the final words the Coldcard showed after the rolls.

With all four, Coinkite does not consider the seed at risk from this issue: 50 to 98 rolls added at least 128 bits of your own randomness, and 99 or more about 256 bits. With fewer than 50 rolls, or any doubt, treat the seed as affected (Coinkite advisory). Why 50? Our dice rolls calculator shows the arithmetic.

Step 4. How urgent is it?

The passphrase is the BIP-39 passphrase, not the Coldcard PIN (Coinkite).

What to do if your seed is affected

1. Erase nothing yet. Test the written backup of your current words and note the wallet's fingerprint (the 8-character XFP code the Coldcard shows) before you erase or replace anything: on a single Coldcard, Coldcard's steps erase the old seed from the device before they make the new one. Coldcard: Never destroy the only working copy of a wallet. Never rely on an untested backup. (Coldcard migration guide). How to test it: testing your seed phrase backup; step 1 of our guide.
2. Install fixed firmware downloaded only from coldcard.com/downloads, after checking the SHA-256 hash and the signed signatures file. As of 3 November 2026 the current standard releases are 5.6.3 (Mk4, Mk5) and 1.5.3Q (Q); 4.2.0 is the final Mk2/Mk3 release (Coldcard security status). Step 3 of our guide.
3. Create a completely new seed on fixed firmware, ideally on a second device. With only one Coldcard, follow the one-device path in Coldcard's migration guide: it switches between the old and new seeds, so both backups must be tested first. Never reuse the old words, and don't use Clone, which copies them. Step 4 of our guide.
4. Test, then move everything. A small test to an address checked on the device screen, then the rest, for every funded wallet on the old seed. Step 5 of our guide.
5. Remake other secrets made on the same firmware: paper-wallet keys, random Seed XOR splits, generated Secure Notes passwords. If you never used these features, skip this step. Our answer.
6. Keep the old backup and the old device until the migration is confirmed (Coinkite asks owners not to dispose of affected devices).

The full explanation, with the reasons behind each step, is in our guide The Coldcard seed entropy flaw: who's at risk and exactly what to do. Coldcard publishes its own version in its migration guide.

Five common mistakes

• I updated the firmware, so I'm fine. An update fixes seeds created from then on. A seed created before stays exactly as weak as it was.
• I restored the words on a new device. Same words, same weakness, on a Coldcard or any other brand.
• I used Clone to move to my new Coldcard. Clone copies the old seed; it does not create a new one.
• My passphrase fixes it. A strong one adds a lock. Coinkite still asks you to migrate as soon as practical.
• A website or support agent can check my seed. No legitimate company asks for your words, and no honest website will offer to check them. Coldcard's own guide says never to enter them into a website or send them to support. Anyone asking is trying to steal them (Coldcard).