Coldcard

Bitcoin-only. Air-gapped. The hardware signer that trusts nothing.

coldcard.com

Zero KYC
CA
Evidence and facts →

Bitcoin-only. Air-gapped. The hardware signer that trusts nothing.

Common useCold storageWallet / Privacy ToolsOperator dataHosted

Identity checksZero KYCNo document check recorded · identity exposure level 0/4

Evidence and riskVerified evidenceDocumented riskMaterial claims checked against current sources.; those sources document a material risk.

Last reviewedReviewed 22 Jun 2026KYC checked 22 Jun 2026 · verified jurisdiction · Source → official siteHow to cite this pageEvidence confidence94/100

Evidence and facts

JURISDICTIONCA

INCIDENT2021-2026 firmware RNG entropy defect and Bitcoin theft
monitoring · critical · since 2026-07-30
A 2021 firmware migration silently routed Coldcard Mk2/Mk3 (firmware 4.0.1-4.1.9) and pre-hotfix Mk4/Q/Mk5 wallet-seed generation to a deterministic software fallback instead of the device's hardware random-number generator, reducing effective seed entropy to roughly 40-72 bits against a 128-bit target. Coinkite disclosed the issue and shipped fixed firmware for every model on 31 Jul 2026. Independent on-chain researchers tracked more than $100 million in Bitcoin swept from affected addresses across multiple waves beginning 30 Jul 2026. Fixed firmware prevents new affected seeds but does not repair seeds already generated on vulnerable firmware; migration to a newly generated seed is required unless the seed was created with at least 50 independent dice rolls or is protected by a strong BIP-39 passphrase. Coinkite security advisory, Coinkite technical backgrounder, Block Engineering independent analysis, Coldcard firmware changelog

AUDITED BYNo audit listed

OPERATOR DATAHosted operator recorded

EVIDENCE CONFIDENCE

THIRD-PARTY REPORTED7/11

Why evidence is 94/100Formula 3.1

Source coverageMaterial claims checked against current sources: +70
Review ageOldest recorded check is 62 days old: +24

Full scoring method

LAST CHECKED2026-06-24

LAST UPDATED2026-03-13

Specs

DOCUMENT CHECKNone recorded

IDENTITY EXPOSURELevel 0/4

KYC TRIGGERSNo account, no KYC for firmware use. Hardware purchase may expose shipping address.

FEE$147-$199 (one-time hardware)

NETWORKSBTC

CATEGORIESWallet, Privacy Tools

COMMON USESCold storage, Air-gapped Bitcoin signing, Maximum self-custody

FEATURESAir-gapped signing, Bitcoin-only, Open source firmware, Duress PIN, PSBT via MicroSD, Sparrow compatible, No computer required, Secure element (SE2)

TORNot listed

REGIONSGlobal availability

Review analysis, source material, related services, and history

About

Bitcoin-only air-gapped hardware signer by Coinkite with PSBT signing over MicroSD or QR and duress PIN support.

Analysis

OVERVIEW

Coldcard is a Bitcoin-only hardware signer from Coinkite that signs PSBTs through MicroSD or QR without a computer connection, and ships with a duress PIN and open source firmware.

LIMITS

Coinkite is based in Canada, a Five Eyes jurisdiction, and while the device itself holds no user data, a hardware purchase can expose a shipping address unless ordered with privacy-preserving delivery.

USEFUL FOR

Matches Bitcoin holders who want air-gapped signing and self-custody and who handle their own purchase and shipping privacy.

Sources · reviewed 2026-07-16

Official site ↗

Corporate identity

Registry-sourced, not audited. The facts below come from cited web research rather than a direct registry query. Each claim links its own source.

LEGAL ENTITY: Coinkite Inc.source ↗
INCORPORATED IN: Ontario, Canadasource ↗
REGISTERED ADDRESS: 3219 Yonge St., Unit 376, Toronto, ON M4N 3S1, Canadasource ↗

Registry research · reviewed 2026-08-09

We wrote about this

Coldcard: 2026 Firmware Random-Number Flaw and Bitcoin Theft

Frequently Asked Questions

Is identity verification required?

No identity verification is recorded for typical use. No account, no KYC for firmware use. Hardware purchase may expose shipping address.

Which payment methods are accepted?

Accepted payment methods: BTC.

Where is it available?

Recorded availability: GLOBAL.

Is the operator based in a Five Eyes country?

Yes. The recorded jurisdiction is CA, a Five Eyes country (US, UK, CA, AU, NZ). This is jurisdiction context and does not by itself establish that a service is safer or less safe.

How are identity, operator, and evidence fields reported?

Identity exposure is level 0 of 4. A hosted operator is recorded. Jurisdiction is shown as context, not a safety verdict. Evidence confidence is 94/100 and recorded risk is danger.

Which payment networks are supported?

Accepted networks: BTC.

Related Services

addy.ioaddy.ioaddy.io · Email · GB

Email aliasing, self-hostable, crypto accepted.

Evidence94 Zero KYCCaution

About Visit ↗

BitBox02bitbox.swissbitbox.swiss · Wallet · CH

Swiss hardware signer taking BTC and Lightning.

Evidence100 Zero KYC

About Visit ↗

BTCPay Serverbtcpayserver.orgbtcpayserver.org · Merchants · JP

Self-hosted Bitcoin and Lightning payments.

Evidence59 Zero KYC

About Visit ↗

Sources and history

Terms and privacy policy

No changes to the documents we watch since we started checking on 9 Aug 2026. Last checked 9 Aug 2026.

Service history

Latest meaningful changes to the facts shown on this provider page.

9 Aug 2026
Corporate registry information updated
Corporate
8 Aug 2026
Provider facts reviewed and updated
Incidents
6 Aug 2026
Add Coldcard RNG entropy incident article and services.json incident record
Incidents, Recorded risk

Full service history

9 Aug 2026updated
Corporate registry information updated
Corporate
not setEntity type: company; Governance model: company-sponsored; Repository url: https://github.com/Coldcard/firmware; Legal entity: Coinkite Inc.; Incorporation jurisdiction: Ontario, Canada; Registered address: 3219 Yonge St., Unit 376, Toronto, ON M4N 3S1, Canada
Review source: official site · public history entry
8 Aug 2026updated
Provider facts reviewed and updated
Incidents
Title: 2021-2026 firmware RNG entropy defect and Bitcoin theft; Status: monitoring; Severity: critical; Started at: 2026-07-30; Resolved at: not set; Summary: A 2021 firmware migration silently routed Coldcard Mk2/Mk3 (firmware 4.0.1-4.1.9) and pre-hotfix Mk4/Q/Mk5 wallet-seed generation to a deterministic software fallback instead of the device's hardware random-number generator, reducing effective seed entropy to roughly 40-72 bits against a 128-bit target. Coinkite disclosed the issue and shipped fixed firmware for every model on 2026-07-31. Independent on-chain researchers tracked more than $100 million in Bitcoin swept from affected addresses across multiple waves beginning 2026-07-30. Fixed firmware prevents new affected seeds but does not repair seeds already generated on vulnerable firmware; migration to a newly generated seed is required unless the seed was created with at least 50 independent dice rolls or is protected by a strong BIP-39 passphrase.; Sources: Label: Coinkite security advisory; Href: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/, Label: Coinkite technical backgrounder; Href: https://blog.coinkite.com/entropy-technical-backgrounder/, Label: Block Engineering independent analysis; Href: https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware, Label: Coldcard firmware changelog; Href: https://github.com/Coldcard/firmware/blob/master/releases/ChangeLog.mdTitle: 2021-2026 firmware RNG entropy defect and Bitcoin theft; Status: monitoring; Severity: critical; Started at: 2026-07-30; Resolved at: not set; Summary: A 2021 firmware migration silently routed Coldcard Mk2/Mk3 (firmware 4.0.1-4.1.9) and pre-hotfix Mk4/Q/Mk5 wallet-seed generation to a deterministic software fallback instead of the device's hardware random-number generator, reducing effective seed entropy to roughly 40-72 bits against a 128-bit target. Coinkite disclosed the issue and shipped fixed firmware for every model on 31 Jul 2026. Independent on-chain researchers tracked more than $100 million in Bitcoin swept from affected addresses across multiple waves beginning 30 Jul 2026. Fixed firmware prevents new affected seeds but does not repair seeds already generated on vulnerable firmware; migration to a newly generated seed is required unless the seed was created with at least 50 independent dice rolls or is protected by a strong BIP-39 passphrase.; Sources: Label: Coinkite security advisory; Href: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/, Label: Coinkite technical backgrounder; Href: https://blog.coinkite.com/entropy-technical-backgrounder/, Label: Block Engineering independent analysis; Href: https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware, Label: Coldcard firmware changelog; Href: https://github.com/Coldcard/firmware/blob/master/releases/ChangeLog.md
Review source: official site · public history entry
8 Aug 2026updated
Provider summary rewritten
Description
Bitcoin-only air-gapped hardware signer. The most trusted hardware wallet in the Bitcoin privacy community. Never connects to a computer. PSBT signing via MicroSD or QR. Duress PIN support. Open source firmware by Coinkite.Bitcoin-only air-gapped hardware signer by Coinkite with PSBT signing over MicroSD or QR and duress PIN support.
Review source: official site · public history entry
7 Aug 2026updated
Provider summary rewritten
Card summary
not setBitcoin-only air-gapped hardware signer.
Review source: official site · public history entry
6 Aug 2026updated
Add Coldcard RNG entropy incident article and services.json incident record
Incidents
not setTitle: 2021-2026 firmware RNG entropy defect and Bitcoin theft; Status: monitoring; Severity: critical; Started at: 2026-07-30; Resolved at: not set; Summary: A 2021 firmware migration silently routed Coldcard Mk2/Mk3 (firmware 4.0.1-4.1.9) and pre-hotfix Mk4/Q/Mk5 wallet-seed generation to a deterministic software fallback instead of the device's hardware random-number generator, reducing effective seed entropy to roughly 40-72 bits against a 128-bit target. Coinkite disclosed the issue and shipped fixed firmware for every model on 2026-07-31. Independent on-chain researchers tracked more than $100 million in Bitcoin swept from affected addresses across multiple waves beginning 2026-07-30. Fixed firmware prevents new affected seeds but does not repair seeds already generated on vulnerable firmware; migration to a newly generated seed is required unless the seed was created with at least 50 independent dice rolls or is protected by a strong BIP-39 passphrase.; Sources: Label: Coinkite security advisory; Href: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/, Label: Coinkite technical backgrounder; Href: https://blog.coinkite.com/entropy-technical-backgrounder/, Label: Block Engineering independent analysis; Href: https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware, Label: Coldcard firmware changelog; Href: https://github.com/Coldcard/firmware/blob/master/releases/ChangeLog.md
Recorded risk
cautiondanger
Review source: official site · public history entry
6 Aug 2026updated
Provider presentation updated
Evidence status
not setverified
Privacy warning
Canada = Five Eyes jurisdiction, but Coldcard is a hardware product - Coinkite holds no user data or keys. Purchase anonymously (use a P.O. box or privacy-preserving shipping). Order with Monero or cash-equivalent if possible. Firmware is open source.Canada = Five Eyes jurisdiction, but Coldcard is a hardware product - Coinkite holds no user data or keys. Purchase anonymously (use a P.O. box or privacy-preserving shipping). Order with Monero or cash-equivalent if possible. Firmware is open source.
Recorded risk
not setcaution
Trust level
cautionnot set
Review source: official site · public history entry
24 Jun 2026updated
Provider facts reviewed and updated
Checked at
2026-06-222026-06-24
Review source: official site · public history entry
22 Jun 2026updated
Ship trust audit remediation pass
Checked at
2026-03-132026-06-22
Jurisdiction confidence
not setverified
KYC last checked
not set2026-06-22
Last reviewed
not set2026-06-22
Source reviewed
not setofficial site
Review source: official site · public history entry
7 Apr 2026updated
Drop warrantCanary trust signal
Warrant canary
nonot set
Review source: source not recorded · public history entry
29 Mar 2026updated
KYC risk level system + advanced directory filters
KYC level
zero0
Review source: source not recorded · public history entry
14 Mar 2026updated
Offline status bug, vetted grid, news/projects img tags
Status
liveok
Review source: source not recorded · public history entry
14 Mar 2026created
Provider presentation updated
Provider profile
not setcreated
Review source: source not recorded · public history entry

Only fields shown on the provider page are tracked. Private identifiers are never published.

Evidence basis: Claims on this page are linked to published sources for comparison, not certification, audit, endorsement, or recommendation; read the methodology and coverage map before relying on an entry.