COLDCARD Seed Migration Runbook

gistfile1.txt

# COLDCARD Seed Migration Runbook

Defensive migration guide for the COLDCARD RNG vulnerability disclosed on July 30-31, 2026.
Based on the public disclosures linked under References. The situation is evolving — check the
official Coinkite advisory for updates before acting.

## 1. Purpose and scope

- This runbook walks you through moving bitcoin off a potentially compromised COLDCARD-generated
  seed and onto a freshly generated wallet, safely and completely.
- It covers single-sig, 25th-word passphrase accounts, multisig, and seeds that were exported to
  other wallets.
- It contains no vulnerability analysis and no recovery tooling. Its only job is to get funds to
  safety.

### Scam warning (read first)

- No legitimate party — Coinkite, Block, your exchange, or this security team — will ever ask for
  your seed words or passphrase, and none will DM you a "migration" or "recovery" tool. Any tool
  that asks for seed words is a theft tool.
- Expect phishing sites, fake firmware, and fake rescue services exploiting this news cycle.
- Download firmware only from coinkite.com and verify signatures using Coinkite's published
  procedure. Do not trust download links from DMs, emails, or search-engine ads.

## 2. Triage: are you affected?

What the public disclosures establish:

- Mk2 and Mk3: seed generation on these devices was deterministic rather than random. Coinkite's
  advisory specifically flags Mk3 seeds generated after firmware 4.0.1; Block's analysis covers
  Mk2 as well. Treat every seed ever generated on these devices as known to the attacker.
- Mk4, Q, and Mk5: a flawed reseed sharply reduced the entropy protecting seeds, per Block's
  analysis. Coinkite's early statement said these models are not affected; Block and independent
  researchers advise migrating anyway. Given that draining is ongoing, the conservative choice is
  to migrate.
- A seed exported from an affected device stays compromised forever, in every wallet it was ever
  imported into. Moving the same words to a new device fixes nothing.

```mermaid
flowchart TD
  A[Seed generated on COLDCARD?] -->|No, generated elsewhere| Safe[Not affected by this issue]
  A -->|Yes| B{Model}
  B -->|Mk2 / Mk3| C[Critical: migrate immediately]
  B -->|Mk4 / Q / Mk5| D[Elevated risk: migrate promptly and deliberately]
  C --> E{Seed exported to other wallets?}
  D --> E
  E -->|Yes| F[Treat every wallet using that seed as compromised]
  E -->|No| G[Only on-device wallet affected]
```

Urgency guidance:

- Mk2/Mk3-generated seeds: treat as actively compromised. Migrate immediately.
- Mk4/Q/Mk5-generated seeds: migrate promptly but deliberately. Do not wait, but do not rush into
  mistakes — careless migration is the other way people lose funds during incidents like this.

## 3. Preparation checklist

Before touching anything, have these ready:

- A way to generate a genuinely new seed that is not affected:
  - A different, reputable hardware wallet, or
  - A COLDCARD updated to the firmware version that Coinkite's advisory designates as fixing this
    issue (do not assume your current version is fixed — check the advisory), or
  - Well-audited offline wallet software on an air-gapped machine — only if you are experienced
    with that workflow.
- A microSD card for air-gapped PSBT transfer (or the NFC/QR workflow your device supports).
- A clean computer for building and broadcasting transactions: updated OS, no remote-access tools
  you did not install, nothing pirated. A live Linux session is a reasonable option.
- Pen and paper (or a steel backup) for the new seed words. No photos, no screenshots, no cloud
  notes.
- An uninterrupted block of time and a private space. You may be racing an attacker; you also
  cannot afford hurried mistakes.

## 4. Step 1: Inventory everything tied to the compromised seed

Each of the following is a separate pool of funds that must be swept:

- The main (no-passphrase) account.
- Every 25th-word passphrase account you have ever used. Each passphrase defines an entirely
  separate wallet. List all passphrases now — a forgotten passphrase means those funds stay behind
  on a compromised seed.
- Multisig wallets where this seed is a cosigner (see Special cases).
- Watch-only wallets (Sparrow, Electrum, etc.) tracking this seed's addresses. Use them to confirm
  which accounts hold UTXOs and their total value.
- Services that auto-deposit to old addresses: exchange withdrawal whitelists, mining pool
  payouts, donation addresses, recurring buys. Note them for the post-migration step.

Check balances before proceeding. If the funds are already gone, see "If funds are already gone"
in Step 4 — and still complete the inventory so no future deposit ever lands on the old seed.

## 5. Step 2: Generate the replacement wallet

- Generate a brand-new seed on the unaffected device or software from the preparation step.
- Never import, restore, or type the old seed into any new device or software. The words
  themselves are the vulnerability; a new home does not fix them.
- Write down the new seed words and verify the backup (re-enter it on the device, or confirm a
  derived receive address matches).
- If you use a passphrase on the new wallet, choose a strong one and store it with the same care
  as the seed. Weak passphrases were specifically called out in the disclosure as being
  brute-forced, and a lost passphrase is unrecoverable.
- Get at least one receive address from the new wallet and verify it on the new device's own
  screen. Everything you sweep is going here.

## 6. Step 3: Plan the sweep

- Sweep everything in one transaction per source wallet: all UTXOs, the full balance, to your new
  address or addresses. Do not send a small "test" amount first. A test send is good practice for
  normal key management, but with a compromised seed it alerts the attacker and leaves the
  remainder exposed while you wait for confirmation.
- Pay a fee that targets next-block confirmation. Check live mempool conditions (for example
  mempool.space, or your own node's estimator) at broadcast time and pay what the next block
  costs. A stuck low-fee transaction is time you are handing to the attacker.
- Enable RBF (replace-by-fee) so you can bump the fee if the transaction stalls.
- Optionally split the sweep into several outputs on different new-wallet addresses within the
  same transaction, for privacy and UTXO hygiene.
- If you have multiple passphrase accounts, prepare all of their sweep transactions before
  broadcasting any of them, so the whole operation finishes in one short session.

## 7. Step 4: Execute

1. Build the full-balance sweep transaction in your watch-only wallet and export it as a PSBT to
   microSD.
2. Sign it on the affected COLDCARD, keeping the device air-gapped. The seed is already presumed
   compromised; signing once more on the device adds no meaningful new exposure. Do not connect
   the device over USB to a networked computer for this.
3. Before broadcasting, compare the destination address in the transaction against the address
   shown on the new device's screen — at minimum the first and last several characters, checked
   carefully.
4. Broadcast from the clean machine.
5. Monitor until confirmed. If it stalls, bump the fee with RBF.
6. Repeat for each passphrase account and each affected wallet, promptly, in the same session.

If funds are already gone:

- Do not send anything further to any address from the old seed, ever. Drained wallets are
  typically monitored for future deposits.
- Preserve evidence: theft transaction IDs, destination addresses, timestamps. Report the
  destination addresses to the exchanges and services they touch, and to law enforcement where
  applicable.

## 8. Special cases

### 25th-word passphrase accounts

- The disclosure explicitly warns that weak passphrases are being brute-forced against compromised
  seeds. A passphrase does not rescue a compromised seed unless it is genuinely strong — and you
  should migrate regardless.
- Sweep every passphrase account you have ever used. Use watch-only wallets to confirm which
  passphrase accounts actually hold funds, including any variations you may have used.

### Multisig

- Inventory how each cosigner seed was generated. Per the disclosure, multisigs with weak key
  generation for more than one key are being drained — for example, a 2-of-3 wallet with two
  COLDCARD-generated cosigner seeds is directly stealable.
- If any cosigner seed is weak, your security margin is reduced; if weak seeds meet or exceed the
  signing threshold, treat the funds as actively at risk.
- Migration path: build a new multisig wallet from all-new, safely generated cosigner seeds and
  sweep the full balance to it.
- If the wallet is shared, coordinate with the other cosigners before moving. Do not improvise a
  quorum decision alone.

### Seeds exported from the vulnerable device

- If the seed was ever imported anywhere else — another hardware wallet, a software wallet, a
  second COLDCARD — every copy is compromised. Migrate all of them. Exporting or importing the
  seed never diluted the compromise.

### Watch-only wallets and xpubs

- Retire every watch-only wallet and every shared xpub tied to the old seed. Never reuse the old
  seed's addresses for any purpose.

## 9. Post-migration hygiene

- Never reuse the old seed or any of its addresses again, including "just a small amount."
- Update every service that deposits to old addresses: exchange withdrawal whitelists, mining
  pool payouts, donation pages, recurring buy plans.
- Mark every physical backup of the old seed COMPROMISED with the date. Do not destroy them while
  any chance remains of an unswept passphrase account — but make sure no one, including future
  you, can mistake them for a usable wallet.
- Optionally keep a watch-only wallet on the old addresses to observe attacker activity. Never
  fund them.
- Bring the new backup up to your normal standard: durable medium, geographically separated
  copies, and a recovery plan your estate can follow.

## 10. FAQ and pitfalls

- "Can I just add or change a passphrase and keep the seed?" No. The seed itself is the
  vulnerability; the attacker enumerates seeds and can test passphrases against them.
- "Can I move the same seed into a brand-new device?" No. New device, same compromised words.
- "Should I test with a small amount first?" Not with a compromised seed. Sweep the full balance
  in one transaction per wallet, with a next-block fee.
- "The mempool is congested — what fee do I use?" Whatever next-block confirmation costs at
  broadcast time, per a live estimator. Use RBF so you can bump if conditions change.
- "How do I know my new firmware is safe?" Check the Coinkite advisory for the firmware version
  designated as fixing this issue, download only from coinkite.com, and verify signatures per
  Coinkite's published procedure.
- "Someone offered me a recovery or migration tool." It is a scam. No legitimate tool will ever
  ask for seed words or a passphrase.
- "My multisig cosigner is unresponsive and funds are at risk." Follow your pre-existing
  agreements. If you and the other responsive cosigners control a quorum, prioritize securing the
  funds into the replacement wallet you all agreed on.

## References

- COLDCARD Mk3 security advisory: https://x.com/COLDCARDwallet/status/2082961993070247948
  (with the linked advisory on blog.coinkite.com)
- Block engineering disclosure thread: https://x.com/max_guise/status/2083007180874379515
  (with the technical write-up on engineering.block.xyz)
- Independent risk assessment: https://x.com/LLFOURN/status/2082990000896147942

This document is based on public disclosures as of July 31, 2026. The Coinkite advisory is the
authoritative source for affected versions and fixed firmware — re-check it before acting.