What is a Coldcard wallet?

Coldcard is a hardware wallet made by Coinkite, a Canadian company that sells only Bitcoin products. It keeps the private keys on the device and signs bitcoin transactions offline. Its documents list the Mk4, Mk5 and Q models, with the Mk5 and Q as the current devices.

How does a Coldcard bitcoin wallet work?

A Coldcard creates and stores the wallet's seed phrase. It does not build transactions by itself. That job goes to a separate wallet app, such as Sparrow or Nunchuk.

Coldcard is known for its security options. Its main PIN comes in two halves. After the first half, the device shows two anti-phishing words, and if they do not match the owner's records, the device may have been tampered with. After 13 wrong PIN attempts the device bricks itself for good. Owners can also set trick PINs that, for example, wipe the seed or open a decoy wallet if someone forces them to unlock it.

The larger Q model has two microSD slots and can run on AAA batteries.

What is an air-gapped PSBT?

A PSBT, or partially signed bitcoin transaction, is a standard file format for a transaction that still needs a signature. Coldcard is built around it.

The usual flow:

1. The wallet app builds an unsigned PSBT.
2. The user moves it to the Coldcard by microSD card, NFC, a USB virtual disk or, on the Q, a QR code.
3. The Coldcard shows the amount, network fee and destination address on its own screen.
4. If the user approves, it signs and hands back the signed file the same way.
5. The wallet app broadcasts it to the network.

"Air-gapped" means the device never needs a live data connection to an online computer. The device warns about very high fees, and Coldcard's guide says users should not sign anything they do not recognize.

What happened with the Coldcard vulnerability?

In July 2026, Coinkite confirmed that a firmware bug had weakened how Coldcard devices generated new seeds. Instead of using the hardware random number chip, affected firmware fell back to a predictable method, so seeds had far less randomness than intended. Attackers recreated some of those keys offline and drained wallets without touching the devices.

The Casa blog reported that about 1,366 BTC was drained on July 30 and 31, 2026, and that thefts continued afterward. Older Mk2 and Mk3 devices were hit hardest, but Coinkite's advisory also covers seeds made on the Mk4, Mk5 and Q before the fixed firmware.

Coinkite released fixed firmware from July 31. It says updating does not repair an existing seed, so seeds created on affected firmware should be replaced and funds moved. A passphrase, covered in what is a seed phrase passphrase, does not fix an affected seed. Coinkite says seeds made with at least 50 private, fair dice rolls are not considered at risk from this bug alone.

Coinkite says owners should check the published fingerprint and signature of any firmware file before installing it. For how Coldcard compares with other device makers, see Trezor vs Ledger.