Devices / COLDCARD Q

COLDCARD Q firmware: latest version, update history & security notes

COLDCARD firmware bug produced weak seeds; funds stolen (Jul 30, 2026). Install fixed firmware (Mk4/Mk5 5.6.0+, Q 1.5.0Q+, Mk2/Mk3 4.2.0+, Edge 6.6.0X/6.6.0QX+), then generate a NEW seed and move funds. Updating alone does not repair an existing affected seed. Coinkite's guidance has an exception for seeds made with at least 50 private, independent dice rolls. Details

Current firmware

1.5.3Q
Released Sep 30, 2026 · 28 days ago · release notes
Releases in last 12 months5
…of which security-flagged2
Releases tracked23

Official price

$319
COLDCARD™ Q · official store price, checked Oct 28, 2026. Prices change; confirm at checkout.

Buy from Coinkite

Get an email when your device has a firmware or security update

Security incidents

Release history

DateVersionHighlights
Sep 30, 20261.5.3QNew Feature: Codex32 (BIP-93) secrets and Shamir secret sharing. Generate or import Codex32; Enhancement: Support per-input required height and time locktimes in PSBTv2 transactions.notes
Sep 3, 20261.5.2QsecurityNew Feature: Added USB ncry v3 authenticated encryption for our USB communications; Enhancement: Warn when a transaction's block-height nLockTime is more thannotes
Aug 20, 20261.5.1QsecuritySecurity Improvement: Require scrolling to reveal locally entered BIP-39 passphrases.; Bugfix: Reject malformed multipart BBQrs that could include stale PSRAM bytesnotes
Jul 1, 20261.4.1QEnhancement: Can export WIF Store watch-only descriptor.; Enhancement: WIF Store address detection without the neednotes
Nov 3, 20251.3.5QEnhancement: Address format guessing changed away from using PSBT XPUB's derivation paths.; Enhancement: Show master XFP of backup secret and ask user for confirmation before loading backup.notes
Sep 30, 20251.3.4QSpending policies for "Single Signers" adds new spending policy options:; limit your Coldcard so it refuses to sign transactions that are "too big"notes
May 14, 20251.3.3QEnhancement: Text word-wrap done more carefully so never cuts off any text, and yet; Bugfix: Add current tmp option, which could be shown in Seed Vault menu undernotes
Apr 16, 20251.3.2QFeature: Key Teleport -- Easily and securely move seed phrases, secure notes/passwords,; can send master seed (words, xprv), anything held in seed vault, secure notes/passwordsnotes
Feb 13, 20251.3.1QNew signing features:; Sign message from note text, or password notenotes
Sep 12, 20241.3.0QNew Feature: Opt-in support for unsorted multisig, which ignores BIP-67 policy. Use; New Feature: Named multisig descriptor imports. Wrap descriptor in json:notes
Jul 5, 20241.2.3QNew Feature: PushTX: once enabled with a service provider's URL, you can tap the COLDCARD; New Feature: Transaction Output Explorer: allows viewing all output details fornotes
Jun 26, 20241.2.2QNew Feature: PushTX: once enabled with a service provider's URL, you can tap the COLDCARD; New Feature: Transaction Output Explorer: allows viewing all output details fornotes
May 9, 20241.2.1Qsecurity_Important Bugfix_: Already imported multisig wallets would show errors when signing. This; Enhancement: Add Nunchuk and Zeus options to Export Walletnotes
Apr 2, 20241.1.0QEnhancement: Scan any QR and report if it is part of a wallet this Coldcard knows; searches up to the first 1528 addresses (external and change addresses)notes
Mar 14, 20241.0.1QEnhancement: Move dice rolls (for generating master seed) to Advanced submenu.; Cleanup reproducible building / start process of backporting to Mk4.notes
Mar 10, 20241.0.0QBump major verison number, remove BETA marking.; Finalize version 1.0.4 bootrom (no real changes).notes
Mar 2, 20240.0.8QBBQr display changes:; if less than 12 frames would result, uses simpliest QR that can fit onnotes
Feb 26, 20240.0.7Qbugfix: BBQr display of some segwit transactions would sometimes fail with message; bugfix: very obscure bug in low level code could cause txid to be miscalculatednotes
Feb 22, 20240.0.6Qsecuritybugfix: randomize keys for PIN entry; when picking files, we just skip to showing you the files options (or picking thenotes
Feb 16, 20240.0.5Qfixes and changes from version 5.2.2 of Mk4 encorporated; bugfix: save bip-39 password to absent SD cardnotes
Feb 15, 20240.0.4QBBQr animation display smoother; test cases fixed, bugs that were exposed, fixed.notes
Feb 8, 20240.0.3Qfirst test-only releasenotes
date not published1.4.0Q
Source lists 2065-03-05, which is in the future (probably a typo in the vendor changelog).
New Feature: Sign BIP-322 Proof of Reserve PSBT files.; Requires a carefully crafted PSBT that does not represent a monetary transaction, but instead is demonstratingnotes

Source: the vendor's public changelog on GitHub (COLDCARD Q standard firmware). Dates are as published by the vendor.

Compare

COLDCARD Q vs Trezor Safe 7