en.bitcoinsistemi.com
Coldcard has released a new firmware update to enhance the security of its hardware wallets. The company stated that some recovery phrases created in previous software versions may pose a potential security risk, and advised affected users to create a new recovery phrase and transfer their assets to the new wallet.
As you know, a security vulnerability in the Coldcard hardware wallet recently resulted in the theft of over $70 million worth of Bitcoin from users’ wallets.
Coldcard has released version 5.6.1 for the Mk4 and Mk5 models, and 1.5.1Q for the Q model. The update is the result of a comprehensive security review lasting approximately three weeks, following the emergency security patch released on July 31st.
With the new firmware, every new recovery string created on Coldcard devices must now include at least one user-provided source of physical entropy.
Users will be able to do this using one of the following options: at least 65 irregular keystrokes, 50 physical dice rolls, or 128 physical coin tosses.
This user-generated randomness will be combined with new entropy derived from the device’s STM32 TRNG hardware and the SE1 and SE2 secure elements. Coldcard stated that this change aims to make the recovery string generation process more resilient to potential attacks.
The update doesn’t just change how recovery statements are generated. The new version also enables real-time and incremental PSBT verification before the signing process.
In addition, security measures for USB connections and firmware update processes have been strengthened, and the Delta Mode isolation mechanism has been improved.
The update addresses several issues related to backing up active wallets, while also implementing more robust random number generators and making error checks more rigorous. Various security and accuracy improvements are included in the update, along with changes to the SIGHASH defaults.
The most important warning in Coldcard’s announcement concerns the current recovery statements.
The company specifically emphasized that installing the new firmware does not eliminate a potential security issue in recovery strings created using previously affected software versions.
Users affected by the security alert must first update their devices to the new firmware version, then create and verify an entirely new recovery string, and transfer their existing Bitcoin assets to the newly created wallet.
Coldcard also strongly advised all Mk4, Mk5, and Q users to update their devices as soon as possible and verify the digital signature of the downloaded firmware file.
*This is not investment advice.