Is COLDCARD safe? What its terms and incident record say
Is COLDCARD safe?
COLDCARD's terms place the keys with you and disclaim access to them. No party is disclosed as able to block an address. 1 primary-source incident is recorded. Its terms name no gambling rule. Liability is excluded for all loss. This answer reads documents; no code audit or test transaction was run.
Documents last checked Reviewed by CryptoGuardz Register Desk, editorial desk
Disclosure: CryptoGuardz has no commercial relationship with COLDCARD and earns nothing if you install it. Every statement below is read from a document COLDCARD publishes or from a public record, and each carries the date it was read. Corrections go to the corrections page.
COLDCARD review: the documents
This is a review of the documents COLDCARD publishes, not a test of the product: no transaction was signed and no code audit was read. The contracting party named is Coinkite Inc.; on jurisdiction the record says: Ontario, Canada, as governing law and place the terms are deemed made and performed. The custody position comes from the Coinkite Terms of Use, last updated 9 June 2022, read 2026-10-07. The record quotes 4 clauses across 4 topics, and 0 sub-service clauses where the app hands a swap, purchase or staking to another party. COLDCARD's terms place the keys with you and disclaim access to them. No cloud or hosted backup is offered; recovery depends on the copy you keep. 1 clause lets the provider suspend or withdraw access to the app; the keys stay yours, the interface does not. Liability is excluded for all loss. Its terms name no gambling rule. 5 points could not be verified and are listed below.
Has COLDCARD been hacked?
One incident is recorded, each from a primary source: a disclosure by the company, a public vulnerability register or a regulator. The descriptions are the record’s, unedited, with the date and the source.
COLDCARD disclosed a firmware bug that weakened seed generation on Mk2, Mk3, Mk4, Mk5 and Q devices. Per Coinkite's own advisory, a 2021 library migration caused seed generation to use MicroPython's Yasmarang software PRNG instead of the hardware TRNG. Attackers regenerated private keys offline and stole funds; Coinkite states the devices were not remotely accessed. Affected firmware: Mk2 and Mk3 4.0.1 to 4.1.9; Mk4 and Mk5 before 5.6.0 or Edge 6.6.0X; Q before 1.5.0Q or Edge 6.6.0QX. Updating does not repair an existing seed; users must migrate. Coinkite gives an exception for seeds that added at least 50 private dice rolls. No total amount stolen and no compensation statement appear on the primary pages.
A COLDCARD firmware bug weakened seed generation. Attackers regenerated the corresponding private keys offline and stole funds; the devices themselves were not remotely accessed or taken over.
An incident on this list is a disclosed event, not a verdict on the product today. The absence of other incidents is not proof that none happened.
COLDCARD support and scams
The official domain in the record is coldcard.com. Type the domain yourself rather than following a link to it.
Real support never asks for a seed phrase. The recovery phrase restores the whole wallet on any device, so whoever is given it can move everything it controls, and no support agent needs it to answer a question. What COLDCARD stores, by the record: Nothing by Coinkite. The device can write an encrypted backup file of the seed to a microSD card held by the user.
Support links reached from ads or direct messages are the commonest drain. A search ad, a reply to a public complaint or a direct message offers help, the link opens a page that looks like coldcard.com, and the page asks you to “validate” or “sync” the wallet by entering the phrase. Once it is typed in, the wallet is emptied and nothing in the terms gives a way back.
If money has already gone, the next message offering to get it back is the commonest second loss. The FBI, the FTC, the CFTC and the UK FCA warnings about it are quoted on crypto scam recovery: what is real.
What we could not verify
The gaps in this record, as the record states them. A point listed here was looked for and not confirmed; it is neither a finding for COLDCARD nor against it.
- The Coinkite terms of sale, which the terms of use say prevail for product purchases. Not located at a public URL in this pass. The warranty, product liability and any sanctions or export terms for the device are therefore not recorded.
- A clause in which Coinkite states in words that it has no access to seeds or keys. None was found in the terms of use, privacy policy or FAQ.
- The total amount stolen in the July 2026 seed-generation incident and whether any compensation is offered. Not stated on the primary pages read.
- Coinkite Inc.'s place of incorporation. Ontario is the governing law; incorporation is not stated.
- The encryption scheme of the microSD backup file. Not described in the FAQ; the firmware documentation was not read.