Is COLDCARD safe? What its own terms say
Is COLDCARD safe to use for casino deposits?
COLDCARD's terms disclaim custody and access to your keys, so by their account only you can sign a deposit. Its terms name no gambling rule (coinkite.com, read 2026-10-07), which is an absence, not a permission. Contracting party: Coinkite Inc., place of incorporation not stated. 5 points are not verified. 1 primary-source incident is recorded. Liability: excluded for all loss.
Documents last checked Reviewed by CryptoGuardz Register Desk, editorial desk
Disclosure: CryptoGuardz has no commercial relationship with COLDCARD, earns nothing if you install it, and has not contacted the company or given it notice of this entry. Every statement below is either a verbatim quote from a document COLDCARD publishes or a statement about a public record, and both carry the date they were read. Corrections go to the corrections page.
1. What this means for you
Consequences first, in the conditional, each one produced by a clause in a document COLDCARD publishes itself. Every line links to that clause, quoted in full and dated. None of them is a claim that COLDCARD can move your coins on chain: the terms disclaim that power and this register takes them at their word on it.
- Your access to the app can be withdrawn if COLDCARD decides to withdraw it The suspension clause enumerates grounds, and one of them is the expiry of a contract between COLDCARD and a technology partner, which is nothing you control.
- You are relying on a document that does not describe the product if you read only the terms The recovery model the marketing pages describe is not the recovery model the binding document describes.
2. What this entry records, and what it does not
This register publishes no number for a wallet. The payout score on the casino register has five defined components and a published arithmetic; no equivalent instrument exists here. What follows is a field-by-field account of what was read, where and when.
| Binding terms | Read in full4 clauses captured verbatim across 4 topics, retrieved 2026-10-07 |
|---|---|
| Contracting entity | Coinkite Inc.No jurisdiction of incorporation stated in the binding document |
| Custody position in the terms | Disclaims custody and disclaims access to key materialAsserted from the product design described in Coinkite's own pages, not from a contract clause: seeds are generated and held on the device, set up without an account or required app. No Coinkite document retrieved states in words that Coinkite has no access to seeds. The July 2026 advisory states attackers regenerated keys offline from weak seeds and that the devices were not remotely accessed; that is a statement about the attack, not about Coinkite's access. |
| Sub-services | 0 clauses recorded. A count of recorded clauses, not of distinct companies. |
| Code audit | Not measuredNo security audit, source review or reproducible-build check has been carried out or read by this register. A wallet's safety is largely decided there, and nothing on this page speaks to it. |
| First-party test | Not measuredNo transaction has been signed, no swap executed and no recovery flow run through this product by this register. |
| Default node provider | Not disclosedNo RPC or node provider is named in any primary document retrieved. |
3. What we could not verify
Every entry carries this section. The gaps are published because a reader deserves the limits of the check as well as its results.
- The Coinkite terms of sale, which the terms of use say prevail for product purchases. Not located at a public URL in this pass. The warranty, product liability and any sanctions or export terms for the device are therefore not recorded.
- A clause in which Coinkite states in words that it has no access to seeds or keys. None was found in the terms of use, privacy policy or FAQ.
- The total amount stolen in the July 2026 seed-generation incident and whether any compensation is offered. Not stated on the primary pages read.
- Coinkite Inc.'s place of incorporation. Ontario is the governing law; incorporation is not stated.
- The encryption scheme of the microSD backup file. Not described in the FAQ; the firmware documentation was not read.
4. Who you are contracting with
The binding document names a company. It does not name a jurisdiction of incorporation, which is a different and smaller gap: a reader can find the counterparty but not the register it sits in.
| Named counterparty | Coinkite Inc.source · retrieved 2026-10-07 |
|---|---|
| Jurisdiction | Ontario, Canada, as governing law and place the terms are deemed made and performed. Not stated as place of incorporation. |
| Relationships disclosed | None disclosed in the terms of use or privacy policy beyond an unnamed third-party logistics provider for deliveries. |
This website is made available by Coinkite Inc. ("us" or "we").coinkite.com
These Terms will be deemed to have been made and performed exclusively in the Province of Ontario, Canada and will be governed by and construed under the laws of the Province of Ontario without giving effect to Ontario's conflict of laws principles.coinkite.com
5. The custody claim, and what the binding document says
The marketing quotes describe no account and no required app rather than using the words self-custody or non-custodial.
Set it up on-device without a COLDCARD account or required companion appcoldcard.com · 2026-10-07
In the event of any conflict or inconsistent between these Terms and our terms of sale in respect of any such purchase, the terms of sale will prevail.coinkite.com · 2026-10-07
Hardware wallet: custody is the device. COLDCARD has no companion app of its own; it is used with third-party coordinator software such as Sparrow, Nunchuk or Specter, under those projects' own terms. The Coinkite Terms of Use cover the website only and contain no clause on private keys, seeds or custody. The quoted sentence is recorded because it is the only statement of what governs a product purchase, and it points to terms of sale that were not retrieved. Quoted verbatim, including the word "inconsistent" as written.
6. Recovery, and where the terms and the marketing differ
| Cloud or hosted backup offered | no |
|---|---|
| What is stored | Nothing by Coinkite. The device can write an encrypted backup file of the seed to a microSD card held by the user. |
| Where | On the device, in the user's own seed record, and optionally on a user-held microSD card. |
| Changes the custody position | no |
COLDCARD can backup the seed into an encrypted filecoldcard.com
The terms of use say nothing about seeds or backup; the FAQ describes a local encrypted microSD backup. No contradiction, because the binding document does not address the device at all. The terms of sale, which govern purchases, were not retrieved.
7. The app is not the wallet
0 clauses, each one a place where the product routes a user to a counterparty the user never contracts with by name, under terms the user never opens. The count is of recorded clauses and not of distinct companies: two entries can name the same counterparty and each still be a separate thing the terms permit.
8. Withdrawing your access to the interface
Your keys are yours. The software you reach them through is licensed, and the licence can be withdrawn. 1 clauses are recorded on this point.
We may change, suspend or discontinue the website at any time without notice or liability.coinkite.com
Applies to the website. The device operates without Coinkite's website or servers.
9. Who can block an address
COLDCARD claims no power to block an address in the documents read. No clause in the documents read discloses that another party in the stack can freeze or blacklist an address either. That is an absence of disclosure, not a guarantee that no such party exists.
10. What the terms say about gambling
Position recorded: not disclosed. No clause naming gambling, betting, casinos or wagering was found in the documents read. That is an absence in the documents, not a permission, and the general prohibition on unlawful use still applies.
The card side of the same question is on the card register, and the casino side on KYC on withdrawal.
11. Chains it names
Of the eight chains this register filters on, COLDCARD names 1: Bitcoin. Not named on the pages read: Ethereum, Solana, TON, Tron, BNB Chain, Base, Polygon. Bitcoin only, by the manufacturer's own FAQ.
Bitcoin and Bitcoin Testnet are supported. COLDCARD does not support altcoins.coldcard.com
12. Liability, amendment, arbitration and where you can use it
The liability clause excludes liability for all loss rather than capping it at a figure. It is the clause that decides what the rest of the document is worth.
In no event shall we be liable for any direct, indirect, consequential, incidental, special, punitive, or other damages whatsoever, or any loss of revenue, profits, or expected savings, business interruption, personal injury, loss of privacy, loss of data or information or other pecuniary or intangible loss arising out of these Terms, the website or the use of or inability to use the website, even if we foresee or have been advised of the possibility of such damages.coinkite.com
Excludes all liability arising from the website. Product liability sits in the terms of sale, which were not retrieved.
We may change these Terms by posting revisions to our website from time to time without notice or liability.coinkite.com
You agree that all claims, disputes or disagreements of any nature whatsoever arising from or relating to these Terms, the website or us (a "Dispute") will, at our sole option, be settled by final and binding arbitration by a single arbitrator pursuant to the Arbitration Act, 1991 (Ontario).coinkite.com
Arbitration at Coinkite's sole option. The Act's name is italicised in the original.
13. Public record
Matters of public record, taken from primary sources and stated with them. Both of the records below were disclosed by the provider itself or entered in a public vulnerability register, rather than found in the press.
COLDCARD disclosed a firmware bug that weakened seed generation on Mk2, Mk3, Mk4, Mk5 and Q devices. Per Coinkite's own advisory, a 2021 library migration caused seed generation to use MicroPython's Yasmarang software PRNG instead of the hardware TRNG. Attackers regenerated private keys offline and stole funds; Coinkite states the devices were not remotely accessed. Affected firmware: Mk2 and Mk3 4.0.1 to 4.1.9; Mk4 and Mk5 before 5.6.0 or Edge 6.6.0X; Q before 1.5.0Q or Edge 6.6.0QX. Updating does not repair an existing seed; users must migrate. Coinkite gives an exception for seeds that added at least 50 private dice rolls. No total amount stolen and no compensation statement appear on the primary pages.
A COLDCARD firmware bug weakened seed generation. Attackers regenerated the corresponding private keys offline and stole funds; the devices themselves were not remotely accessed or taken over.
14. Who should avoid COLDCARD
Anyone who needs a named party to be answerable for a loss. The liability position is excludes liability for all loss, and the terms disclaim responsibility for every third-party service the app routes you into.
Related entries
Or read the whole wallet register, the card register, the same method applied to exchanges and to crypto casinos, the clause library at clause watch, or how this register works.