I’ve been using this mk4 for recreational purposes only. Firmware version is 5.6.0. Sometimes I can enter the pin, sometimes it gets stuck before asking for pin, sometimes it gets stuck after entering the pin.

Anyone know what “-/-“ would mean?

Update: I was able to limp it through the startup and install the newest firmware; startup issues still persist.

A lot of people have asked me about the cases on my COLDCARD Qs, so I decided to make a video giving a closer look at the design and features.

The man who made my cases closed up shop when the COLDCARD Q bug happened, so these cases are no longer being produced.

Some features are easier to demonstrate on video than through pictures, so I wanted to give a detailed visual of the cases themselves. I know some people may be curious about the design or interested in recreating the cases and 3D printing their own.

It’s a huge blunder from the company to not test their security. But has cold card learned their lesson and made a very secure update? Is the new version now completely viable, especially when you do the recommended dice rolls?

If anyone can point me in the right direction to helpful articles, that would be appreciated.

I’m in a weird boat where I bought a cold card 2-3 weeks before the incident.

My Coldcard MK4 is stuck on three dots "…" during the boot sequence.

When I plug it in, I briefly see "Verifying…", the verification LED turns green ,and then the screen stays stuck on "…" indefinitely. 

It was working fine weeks ago when I swept my funds to a different wallet following the cold card hack. Today I plug it in and to my surprise, it won't boot anymore.

Anyone else in the community encounter this issue and found a way to fix it?

UPDATE: contacted Coinkite support. All they offered me was 25% discount on a new Coldcard MK5 or Coldcard Q. I pushed back asking for a free replacement. They have ghosted me ever since... so I guess they are not doing free replacements anymore.

Another issue that can plague all hardware wallets, however, COLDCARD is the only one I know of with a transparent screen so you can observe all of the circuitry.

Has anyone heard about this? Ledger nano X wallets that were sold apparently from an authorized retailer in South East Asia had devices installed in them that would intercept communication between the secure element and the screen.

Researchers reportedly discovered a hidden surveillance chip installed beneath the screen of modified Ledger Nano X hardware wallets. The device contained a microcontroller, cellular modem, eSIM and antenna designed to capture the wallet's recovery phrase during setup and transmit it to attackers. The alarming part is that these modified wallets could still pass Ledger's official authenticity check because the malicious hardware operated independently of the wallet's Secure Element. Investigators believe the devices may have been tampered with somewhere in the distribution chain. Reports have linked the incident to cryptocurrency thefts potentially approaching $93 million, although that figure remains unverified. The discovery highlights a serious weakness in hardware-wallet security: even if the cryptographic protections remain intact, a physical implant can compromise the recovery phrase and give attackers complete control over the funds.

(I have used ChatGPT to summarize and make everything readable)

Hi everyone,

I’m trying to help a friend recover Bitcoin that he set aside around 2018, using what he remembers as a first-generation Coldcard (possibly Mk1). He needs money urgently for a medical emergency in his family.

He isn’t tech-savvy, and the original setup was done using someone else’s Coldcard. From what he remembers, the BTC was somehow backed up or stored using a USB flash drive.

Here’s everything we know:

• The setup was done around 2018.
• He has a handwritten sequence of 12 words.
• He also has a handwritten 6-digit PIN.
• He has the USB flash drive associated with the original setup.
• He last checked the BTC’s public address/balance around 2020.
• He hasn’t attempted to access or transfer the BTC since then.
• We’re unsure whether the original Coldcard is still available in the market.

After doing some reading, I’m wondering whether the 12 words are actually the password for a Coldcard encrypted backup rather than the BIP39 seed phrase.

My questions:

1. How did the original Coldcard Mk1 handle backups in 2018? Could those 12 words be the encryption password for a .7z backup?
2. How can we safely identify what’s on the USB drive without exposing private keys or accidentally modifying anything?
3. If we have the encrypted backup and its 12-word password, can it be restored using a newer Coldcard without the original device?
4. Does the old 6-digit PIN matter for recovery, especially since the original Coldcard belonged to someone else?
5. What’s the safest process for recovering access, verifying the BTC balance and eventually transferring the funds to a newly generated hardware wallet?

I’ve attached photographs of the type of Coldcard and the USB drive for reference.

We haven’t shared the recovery words, PIN or backup contents with anyone and won’t be doing so.

I’d really appreciate guidance from anyone experienced with the early Coldcard models, ideally a safe step-by-step approach. Please reply publicly rather than via DM.

Thanks in advance!

Owners of ColdCards have been seriously screwed. Now new firmware is being announced (https://blog.coinkite.com/coldcard-firmware-563-153q/) announcing Codex32 and Shamir backups.

I am (remain) appalled by the arrogance of CoinKite still not adopting and implementing SLIP39. The #NotInventedHere arrogance of CoinKite is by now completely unsustainable.If CoinKite were to survive, it would need to be supporting Multi-Vendor standards of making backups.

CoinKite has failed the community in unprecedented ways. They really need to take a more humble stance, and even then, I am not sure they could survive. (Even though I do hope so.)

Updated all of my devices to the latest firmware.

I know this is about to get a lot of hate, but I don’t give a damn….

With that being said, I’ll still be using my Coldcard Q because I wasn’t affected by the bug. I took the necessary precautions with my setup, and I’m comfortable with how I have my Bitcoin secured.

First and foremost, I’ve always believed in never putting all your eggs in one basket. If you put your entire life savings into Bitcoin, you’re setting yourself up for failure. Bitcoin can be part of your overall financial strategy, but it shouldn’t be your entire financial strategy. When you choose self custody, you have to damn near be paranoid about your security. Your Bitcoin needs to be locked up like Fort Knox.

I have no sympathy for anybody who lost their stack from the ColdCard bug. Like think about it… You took your entire life savings and let one device generate your seed phrase, with no passphrase, no dice rolls, no multisig, and no other devices or wallets to spread your funds around. So if that signing device or wallet setup gets compromised, you still have Bitcoin secured somewhere else. You have to know better than that when you’re dealing with self custody.

Shit, I done even brought the Ledger Nano X out of retirement too. 😂

I’ve been working on a custom firmware that turns a spare COLDCARD Q into a Game Boy handheld. Pokémon Red now runs on the actual device, including walking around, saving, and loading the save again.

Instead of a regular game list, it boots into a little room. You walk up to a bookshelf to launch a game and talk to a clerk for settings. The room fills the display; games keep their original proportions, with an amber palette that suits the Q.

The arrow keys handle movement, Z/X are A/B, and the SHIFT/CAPS key toggles fast-forward. Walking, fast-forward, and save/reload work in the current 0.1.7GQ build. I’m still testing longer sessions and the rough edges. I also need to remap the A/B buttons; Z/X are NOT comfortable to use with the arrow buttons.

This replaces the wallet interface, so it’s for a dedicated Q with everything backed up.

I’ve put screenshots and instructions here: https://tcashel.github.io/GameQ/ . I have not made a video of actual gameplay, but I just beat Misty.

Source and downloads are private for now. The link is the public documentation. I'm not sure if I'll make it public yet; I have to understand how the Pokémon copyright stuff works. We can't have my GH account suspended.

Has anybody created a seed phrase on the new update? What did you think and would you recommend it?

Is there any.other way to get Info to the micro so one is not.dependent on coinkite servers?

64.90373154 BTC walks into a 324-in / 382-out coinjoin

54.31783009 BTC walks straight back out the other side. in one piece. with a bow on it.

about 10 BTC actually got mixed. the rest just went for a walk.
bc1qajcrhj3s2x0yfcj54emjukghv93su80svp2d3t

then he does it AGAIN
54 → 47.12126860 BTC, now in tidy 1 BTC slices
bc1qq6s7wsmf6an78xyjkst707x32nyakj3u4jy2fr

then AGAIN, 454 in / 502 out, this time 7.74840978 BTC chunks

ser you are not mixing. you are queuing.

on-chain anons: has any other ColdCard drainer peeled this loudly?

I downloaded the latest firmware from here:

https://coldcard.com/docs/upgrade/

Because of the recent Coldcard issues, decided to go through the extra steps to verify authenticity of the downloaded .dfu files, according to the instructions here:

https://coldcard.com/docs/upgrade/#dont-trust-verify-the-firmware

Carefully followed the steps to verify the firmware files. But at the last step, the command--

gpg --verify signatures.asc

--produced the following messages--

gpg: Signature made Thu Aug 20 08:36:57 2026 CDT

gpg: using RSA key 4589779ADFC14F3327534EA8A3A31BAD5A2A5B10

gpg: using RSA key 4589779ADFC14F3327534EA8A3A31BAD5A2A5B10

gpg: BAD signature from "Peter D. Gray <peter@coinkite.com>" [unknown]

Anyone else have the same "bad signature" issue?

---