Devices / COLDCARD Mk4 / Mk5

COLDCARD Mk4 / Mk5 firmware: latest version, update history & security notes

COLDCARD firmware bug produced weak seeds; funds stolen (Jul 30, 2026). Install fixed firmware (Mk4/Mk5 5.6.0+, Q 1.5.0Q+, Mk2/Mk3 4.2.0+, Edge 6.6.0X/6.6.0QX+), then generate a NEW seed and move funds. Updating alone does not repair an existing affected seed. Coinkite's guidance has an exception for seeds made with at least 50 private, independent dice rolls. Details

Current firmware

5.6.3
Released Sep 30, 2026 · 28 days ago · release notes
Releases in last 12 months5
…of which security-flagged2
Releases tracked30

Official price

$219 $269
COLDCARD Mk5 (Mk4 is no longer listed in the official store) · official store price, checked Oct 28, 2026. Prices change; confirm at checkout.

Buy from Coinkite

Get an email when your device has a firmware or security update

Security incidents

Release history

DateVersionHighlights
Sep 30, 20265.6.3New Feature: Codex32 (BIP-93) secrets and Shamir secret sharing. Generate or import Codex32; Enhancement: Support per-input required height and time locktimes in PSBTv2 transactions.notes
Sep 3, 20265.6.2securityNew Feature: Added USB ncry v3 authenticated encryption for our USB communications; Enhancement: Warn when a transaction's block-height nLockTime is more thannotes
Aug 20, 20265.6.1securityImprovements to Entropy Generation:; Master seed generation now combines fresh entropy from the STM32 TRNG,notes
Jul 1, 20265.5.1Enhancement: Can export WIF Store watch-only descriptor.; Enhancement: WIF Store address detection without the neednotes
Nov 3, 20255.4.5Enhancement: Address format guessing changed away from using PSBT XPUB's derivation paths.; Enhancement: Show master XFP of backup secret and ask user for confirmation before loading backup.notes
Sep 30, 20255.4.4Spending policies for "Single Signers" adds new spending policy options:; limit your Coldcard so it refuses to sign transactions that are "too big"notes
May 14, 20255.4.3Enhancement: Text word-wrap done more carefully so never cuts off any text, and yet; Bugfix: Add current tmp option, which could be shown in Seed Vault menu undernotes
Apr 16, 20255.4.2Huge new feature: CCC - ColdCard Cosign; COLDCARD holds a key in a 2-of-3 multisig, in addition to the normal signing key it has.notes
Feb 13, 20255.4.1New signing features:; Sign message from note text, or password notenotes
Sep 12, 20245.4.0New Feature: Opt-in support for unsorted multisig, which ignores BIP-67 policy. Use; New Feature: Named multisig descriptor imports. Wrap descriptor in json:notes
Jul 5, 20245.3.3New Feature: PushTX: once enabled with a service provider's URL, you can tap the COLDCARD; New Feature: Transaction Output Explorer: allows viewing all output details fornotes
Jun 26, 20245.3.2New Feature: PushTX: once enabled with a service provider's URL, you can tap the COLDCARD; New Feature: Transaction Output Explorer: allows viewing all output details fornotes
May 9, 20245.3.1security_Important Bugfix_: Already imported multisig wallets would show errors when signing. This; Enhancement: Add Nunchuk and Zeus options to Export Walletnotes
Dec 21, 20235.2.2Bugfix: Re-enable Lock Down Seed feature which was disabled by accidentnotes
Dec 19, 20235.2.1New Feature: Temporary Seed import from a COLDCARD encrypted backup.; New Feature: Export seed words in SeedQR format (on screen QR).notes
Oct 10, 20235.2.0New Feature: Seed Vault. Store multiple temporary secrets into encrypted settings for simple; New Feature: PSBTv2 support added! Enables new PSBT workflows and applications.notes
Sep 8, 20235.1.4Bugfix: Most users would see a red light after upgrade to 5.1.3 from 5.1.2. Fixed.notes
Sep 7, 20235.1.3New Feature: Batch sign multiple PSBT files. Advanced/Tools -> File Management -> Batch Sign PSBT; Enhancement: Sparrow Wallet added as an individual export option (same file contents)notes
Apr 7, 20235.1.2Enhancement: Support all SIGHASH types (previously only SIGHASH_ALL was supported).; Enhancement: SeedXOR now supports 12 and 18 words mnemonics.notes
Feb 27, 20235.1.1Bugfix: Same as 5.1.0 but corrects issue which prevented 5.1.0 from being upgradednotes
Feb 27, 20235.1.0New Feature: "MicroSD card as Second Factor". Specially marked MicroSD card must be; New Feature: Import TAPSIGNER encrypted backup as main or ephemeral seed, for PSBT signing.notes
Oct 5, 20225.0.7NFC Enhancements:; In older versions, multisig NFC import not offered if a MicroSD card wasnotes
Jul 29, 20225.0.6securitySecurity release: Virtual Disk feature updated with bugfix to address potential securitynotes
Jul 20, 20225.0.5Enhancement: BIP-85 derived passwords. Pick an index number, and COLDCARD will derive; Documentation: added docs/bip85-passwords.md documenting new BIP-85 passwords andnotes
May 27, 20225.0.4Enhancement: Optional USB protocol change which binds the ephemeral ECDH encryption; Enhancement: In HSM mode, when more than 1k approvals, handle overflow in display,notes
May 4, 20225.0.3Enhancement: Support P2TR outputs (pay to Taproot) in PSBT files. Allowsnotes
Apr 19, 20225.0.2Adds NFC support for exporting to all the various wallet-types.; Multisig wallet specs can be exported via NFC, and new multisig wallet can be imported over NFC.notes
Mar 24, 20225.0.1bugfix: red light whenever MCU keys changed or seed installed first time.notes
Mar 14, 20225.0.0(Mk3&Mk4) Performance improved: some internal objects cached to reduce delays when; Enhancement: Power-down during the login countdown now resets the time delay to forcenotes
date not published5.5.0
Source lists 2065-03-05, which is in the future (probably a typo in the vendor changelog).
This release supports both the newer Mk5 hardware and existing Mk4.; Enhancement: Show QR of XOR-split seeds.notes

Source: the vendor's public changelog on GitHub (COLDCARD Mk4/Mk5 standard firmware). Dates are as published by the vendor.

Compare

COLDCARD Mk4 / Mk5 vs Trezor Safe 3 · Blockstream Jade Plus vs COLDCARD Mk4 / Mk5