Coinkite warns Coldcard Mk3 users of firmware flaw that may have compromised wallet seeds

If you have a Coldcard Mk3 sitting in a drawer, this is the week to dig it out. Coinkite has issued a security advisory warning that seeds generated on Mk3 devices running firmware versions 4.0.1 through 5.0.3 may be compromised, pointing to a possible flaw in the device’s random number generator. The advisory is prominently displayed on Coinkite’s firmware downloads page, which signals this is not a quiet disclosure buried in a changelog. What the flaw actually means When you set up a hardware wallet, the device generates a seed, a string of words that is the master key to everything in your wallet. That seed is supposed to be random, truly random, so nobody can guess or recreate it. If the RNG has a flaw, the seeds it produces may not be as random as they appear, and potentially reproducible by someone who knows about the flaw. The affected firmware range spans from version 4.0.1, released in March 2021, through version 5.0.3. Any Mk3 device that generated a seed while running any of those versions could be affected. Coinkite’s initial analysis confirms that the Mk4, Q, and Mk5 models are not impacted by this issue. Coinkite has not disclosed whether the flaw has been actively ex...