Coldcard Adds 65 Key Presses to Setup After Seed Exploit

Setting up a Coldcard just got significantly more tedious. It's for good reason, though. Following a seed generation exploit, the hardware wallet provider rolled out firmware updates requiring 65 distinct key presses during initial wallet creation.

You'll find these hardening fixes in firmware versions 5.6.1 and 1.5.1Q. The additional button inputs exist to secure the creation of fresh seed phrases against potential attack vectors.

Here's the catch. Updating your firmware won't clean up a dirty seed.

If you generated a wallet on an affected software release, patching the physical device does not secure your existing keys. Code can't repair previously exposed entropy. Anyone holding funds in a wallet created on vulnerable code has to update their Coldcard, generate a brand new seed, and manually transfer their crypto over.

Why it matters

Hardware wallets are meant to be the ultimate line of defense for self-custody. Key generation flaws break that trust model completely. A simple firmware update won't protect assets tied to an exposed recovery phrase. If you set up a Coldcard on a vulnerable release, sweeping your funds to a fresh seed is the only way to lock the door.