Mandatory updates for MK4, MK5 and Q models.

[satscraper]

Coinkite urgently released security updates for their popular models MK4, MK5, and Q that fix the entropy flaw present in every firmware version from 4.0.1 onward.

These are all mandatory updates, so owners of MK4 and MK5 must flash their wallets with v5.6.0 firmware, while those who use tQ model have to do so with v1.5.0Q.


Detailed security guidance can be found here.

[promise444c5]

In addition, I think it’s worth mentioning that updating the firmware only won’t fix the existing seed..they need to generated a new seed, test it by reimporting , after updating their firmware to the latest and move the funds into it  before assuming everything is fine.

It’s sad to hear that a lot of people lose their BTC fr .. wish them a speed recovery from it.

[satscraper]

In addition, I think it’s worth mentioning that updating the firmware only won’t fix the existing seed..they need to generated a new seed, test it by reimporting , after updating their firmware to the latest and move the funds into it  before assuming everything is fine.

Yeah, it goes without saying, and they clearly said this in the advisory referenced in the OP

P.S.I think the current case is the lesson for some people who blindly rely on wallets, seeing the open-source 'magnet' from their developers. An entropy-related flaw existed in Coinkite's firmware for a long time, but it turned out that no one was actually reading their code.

[Meuserna]

P.S.I think the current case is the lesson for some people who blindly rely on wallets, seeing the open-source 'magnet' from their developers. An entropy-related flaw existed in Coinkite's firmware for a long time, but it turned out that no one was actually reading their code.

That's because ColdCard's code isn't open source.

Years ago, ColdCard switched their code from being open source to being "Source Verifiable" in order to prevent other developers from legally using ColdCard's code on their own projects. That decision, based on greed and hubris, had brutal consequences.

It led to fewer devs using ColdCard's code.

Fewer devs using the code meant fewer devs finding errors and issues.

Fewer devs finding errors and issues meant errors and issues weren't fixed... such as the error in how ColdCard was generating seeds with nowhere near enough randomness.

The error was found by hackers who exploited it to find wallets with a balance, which they drained this week.

This is a perfect example of why open source matters.

[NotATether]

That's because ColdCard's code isn't open source.

Years ago, ColdCard switched their code from being open source to being "Source Verifiable" in order to prevent other developers from legally using ColdCard's code on their own projects. That decision, based on greed and hubris, had brutal consequences.

It led to fewer devs using ColdCard's code.

Fewer devs using the code meant fewer devs finding errors and issues.

Fewer devs finding errors and issues meant errors and issues weren't fixed... such as the error in how ColdCard was generating seeds with nowhere near enough randomness.

The error was found by hackers who exploited it to find wallets with a balance, which they drained this week.

This is a perfect example of why open source matters.

This bug was entirely the fault of the 'source verifiable' rewrite, the vulnerability was introduced in that set of commits.

So if NVK and the others simply left the code as open source then none of this would have ever happened.

Or alternatively, had they audited the patches they made to the codebase with a 3rd party company, this would've most likely have been avoided too.

Fewer devs is not an excuse for no audits. This is a hardware wallet company ffs.

[satscraper]

P.S.I think the current case is the lesson for some people who blindly rely on wallets, seeing the open-source 'magnet' from their developers. An entropy-related flaw existed in Coinkite's firmware for a long time, but it turned out that no one was actually reading their code.

That's because ColdCard's code isn't open source.

Years ago, ColdCard switched their code from being open source to being "Source Verifiable"

But AFAIK this entropy related flaw crawled into their firmware back in 2021 when the code was open source. So even if they closed it a year ago, it remained open for everyone to read and scrutinize for at least four years. I don't know whether it is true or not, but I read somewhere that hackers found this "Achilles' heel" with the help of AI. If it turns out to be true, then one may expect more similar "findings" in all types of wallets, not only in hardware ones.

[Meuserna]

P.S.I think the current case is the lesson for some people who blindly rely on wallets, seeing the open-source 'magnet' from their developers. An entropy-related flaw existed in Coinkite's firmware for a long time, but it turned out that no one was actually reading their code.

That's because ColdCard's code isn't open source.

Years ago, ColdCard switched their code from being open source to being "Source Verifiable"

But AFAIK this entropy related flaw crawled into their firmware back in 2021 when the code was open source.

It became part of ColdCard's firmware in the first firmware update after Coinkite make the code no longer open source, in March 2021.

Edited to add: And because ColdCard's code was no longer open source, there was no incentive for other devs to work with the code, which led to fewer experienced eyes reading and scrutinizing the code. This bug was one line of code that functioned properly as written, because it technically wasn't an error (even though it was), so it was far less likely to have been spotted by anyone not actually using the code in their own work. Why no one at Coinkite found it is inexplicable and unforgivable. But I firmly believe, if the code had been open source, someone else quickly would have.