From 48086cc7839d132cf95c664bc5013dd7458e1c29 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=B3bert=20Nagy?= Date: Thu, 6 Aug 2026 10:24:44 +0300 Subject: [PATCH 1/2] docs: warn about Coldcard Mk3 seed-entropy advisory (Coinkite, Jul 2026) --- electrum/plugins/coldcard/README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/electrum/plugins/coldcard/README.md b/electrum/plugins/coldcard/README.md index c5cf55bc1f94..11936d3245fd 100644 --- a/electrum/plugins/coldcard/README.md +++ b/electrum/plugins/coldcard/README.md @@ -1,5 +1,9 @@ # Coldcard Hardware Wallet Plugin +## ⚠ Security notice + +Coinkite disclosed (July 2026) a firmware build error that reduced generated-seed entropy on **Coldcard Mk3** (firmware 4.0.1–5.0.3) and pre-fix **Mk4/Q**. Seeds generated on-device without extra dice rolls may be brute-forceable. Update to fixed firmware, generate a new seed and move your funds. See the [Coinkite advisory](https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/). + ## Just the glue please This code connects the public USB API and Electrum. Leverages all From 409325fbedaaa8c2a6a5c0588e18280cc799cb4f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=B3bert=20Nagy?= Date: Thu, 6 Aug 2026 16:37:57 +0300 Subject: [PATCH 2/2] docs: remove unicode from Coldcard security notice (per maintainer request) --- electrum/plugins/coldcard/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/electrum/plugins/coldcard/README.md b/electrum/plugins/coldcard/README.md index 11936d3245fd..139aaead1c4a 100644 --- a/electrum/plugins/coldcard/README.md +++ b/electrum/plugins/coldcard/README.md @@ -1,8 +1,8 @@ # Coldcard Hardware Wallet Plugin -## ⚠ Security notice +## Security notice -Coinkite disclosed (July 2026) a firmware build error that reduced generated-seed entropy on **Coldcard Mk3** (firmware 4.0.1–5.0.3) and pre-fix **Mk4/Q**. Seeds generated on-device without extra dice rolls may be brute-forceable. Update to fixed firmware, generate a new seed and move your funds. See the [Coinkite advisory](https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/). +Coinkite disclosed (July 2026) a firmware build error that reduced generated-seed entropy on **Coldcard Mk3** (firmware 4.0.1-5.0.3) and pre-fix **Mk4/Q**. Seeds generated on-device without extra dice rolls may be brute-forceable. Update to fixed firmware, generate a new seed and move your funds. See the [Coinkite advisory](https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/). ## Just the glue please