Denver Bitcoin shoots his ColdCard Q to protest firmware vulnerability

Hardware wallets are supposed to be the gold standard of Bitcoin security. The whole pitch is simple: keep your keys offline, away from hackers, away from exchanges, away from anything that could go wrong. So when a firmware flaw undermines that promise, the community tends to notice. When someone responds by literally shooting the device, everyone notices. That is exactly what happened when Adam, known on X as @denverbitcoin, announced plans to destroy his ColdCard Q on August 2, 2026, framing the act as a symbolic gesture on behalf of users hurt by the vulnerability. What the flaw actually did When a ColdCard Q automatically generated a seed phrase, it drew on a pool of randomness that was limited to 32 bytes of entropy, making the seed theoretically easier to brute-force than users were led to believe. The practical impact depended heavily on whether a user had added a passphrase, sometimes called the 25th word. A passphrase is an extra layer on top of the standard 24-word seed phrase. Users who had one were largely insulated from the problem. Users who had not were the ones left exposed. Coinkite, the company behind the ColdCard lineup, acknowledged the issue and released updat...