Key Takeaways
- • Coldcard CEO NVK disputed claims of a device-wide vulnerability affecting the hardware wallet, stating that reported security issues may stem from user-imported seeds rather than inherent device flaws.
- • Multiple security vulnerabilities have been identified across Coldcard hardware wallet models, including physical PIN extraction attacks on the Mk2 and arbitrary keypath generation issues on the Mk4.
- • The ESP32 chip—commonly used in budget Bitcoin hardware wallets—contains a recently discovered critical vulnerability that poses risks to lower-cost wallet implementations across the industry.
- • Coldcard maintains dual secure elements and open-source, reproducible firmware as core security features, with the company operating a responsible disclosure process for security researchers reporting vulnerabilities.
- • Hardware wallet security remains a critical concern for institutional cryptocurrency custodians, with address verification and seed generation quality identified as essential verification steps for users.
Summary
Coldcard, a leading hardware wallet manufacturer owned by Coinkite, faces ongoing scrutiny regarding security vulnerabilities across multiple device generations. CEO NVK recently denied the existence of a device-wide vulnerability, suggesting that reported security incidents may result from users importing previously compromised seed phrases rather than flaws inherent to the device itself. This response indicates a distinction between device-level security defects and user-error or external compromise scenarios.
The disclosed vulnerabilities span multiple Coldcard models. The Mk2 has a documented physical vulnerability enabling attackers to extract the device's PIN code through direct hardware manipulation. The Mk4 has been flagged for allowing arbitrary keypath generation limited only by available device memory, creating potential attack vectors for address derivation manipulation. Additionally, the broader ecosystem faces exposure through the ESP32 chip, frequently deployed in lower-cost Bitcoin hardware wallets, which contains a recently identified critical vulnerability affecting multiple manufacturers' products.
Coldcard's security architecture relies on dual secure elements protecting wallet secrets and open-source, reproducible firmware enabling third-party verification of code integrity. The company maintains a formal responsible disclosure process, requesting security researchers submit reproducible proof-of-concept reports through official security channels to preserve user data and enable coordinated patching.
For institutional investors and family offices holding cryptocurrency through hardware wallets, this disclosure underscores the importance of rigorous seed generation practices—specifically avoiding low-entropy diceroll generation and preventing seed reuse across devices. Address verification remains critical throughout transaction workflows, and institutional custodians should evaluate hardware wallet selections based on dual-element security architecture and verifiable open-source firmware alongside transparent vulnerability disclosure history.
The disclosed vulnerabilities span multiple Coldcard models. The Mk2 has a documented physical vulnerability enabling attackers to extract the device's PIN code through direct hardware manipulation. The Mk4 has been flagged for allowing arbitrary keypath generation limited only by available device memory, creating potential attack vectors for address derivation manipulation. Additionally, the broader ecosystem faces exposure through the ESP32 chip, frequently deployed in lower-cost Bitcoin hardware wallets, which contains a recently identified critical vulnerability affecting multiple manufacturers' products.
Coldcard's security architecture relies on dual secure elements protecting wallet secrets and open-source, reproducible firmware enabling third-party verification of code integrity. The company maintains a formal responsible disclosure process, requesting security researchers submit reproducible proof-of-concept reports through official security channels to preserve user data and enable coordinated patching.
For institutional investors and family offices holding cryptocurrency through hardware wallets, this disclosure underscores the importance of rigorous seed generation practices—specifically avoiding low-entropy diceroll generation and preventing seed reuse across devices. Address verification remains critical throughout transaction workflows, and institutional custodians should evaluate hardware wallet selections based on dual-element security architecture and verifiable open-source firmware alongside transparent vulnerability disclosure history.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.