On July 30, Coinkite published a security advisory warning that recovery phrases generated on a Coldcard Mk3 running firmware 4.0.1 or later may put funds at risk. The issue runs through 5.0.3, the final firmware released for that model, and Coinkite says its other devices aren't affected based on early analysis, however, the situation is still unfolding.
Blockstream Jade lineup is unaffected.
Have a Coldcard and in a hurry? Slow down, and carefully do these four things:
1. Create a brand-new wallet in the Blockstream app. Do not restore your old recovery phrase.
2. Send your full balance to the new wallet today.
3. Never type your recovery phrase into a website, form, or "checker" tool.
4. Order a Jade and move to cold storage on fresh keys.
Understand one thing before anything else: the Coldcard vulnerability is not a bug you can patch. If your wallet was created with a weak seed, updating the firmware changes nothing. The keys themselves are the problem. The only fix is to move your bitcoin to a wallet with properly generated keys.
Step 1: Generate Fresh Keys
Create a new wallet and let it generate its own recovery phrase from scratch. Do not restore your existing recovery phrase into the new wallet. Restoring only carries potentially vulnerable keys over to your new wallet.
If a hardware wallet is already in your hands, generate there and skip ahead. If not, don't let shipping time keep your bitcoin sitting on compromised keys.
- Create the wallet in the Blockstream app or your preferred software wallet in the meantime.
- Write the new recovery phrase down and store it safely on either paper (for convenience), or metal for true long-term resilience. Never take a screenshot, save it to a password manager, or a note in the cloud.
Step 2: Verify the New Receive Address
Generate a receive address in the new wallet, then confirm it on the screen of the device. Confirm it matches what is on your computer or phone screen.
Step 3: Send a Test Transaction, Then the Rest
Send a small amount to the new address first. Wait for it to confirm, then check that the balance actually appears in the new wallet and that you can see it from a fresh session, not just the screen you were already looking at.
Once the test lands and you've confirmed you can see it, proceed calmly, and move the full balance.
Step 4: Retire the Old Recovery Phrase Safely
Keep the old backup until the migration is completely confirmed. Destroying it early, while any balance remains, makes that balance unrecoverable.
Look for small leftover amounts, unconfirmed transactions, and any additional accounts or asset types you may have used on that device.
Once the old wallet is confirmed empty and the new one is verified working:
- Destroy the old backup. Shred or burn paper; for a metal backup, physically destroy or restamp it.
- Treat that phrase as permanently retired. Never import it into another wallet, never reuse it as a passphrase, and never enter it into a website, form, or phishing tool offering to check whether it's affected.
If you can't destroy the backup immediately, store it somewhere separate from your new backup so you never confuse the two.
How Jade Builds Its Randomness
Your recovery phrase is only as strong as the randomness behind it, so Jade never relies on a single source. Every Jade hashes together:
- Timing from user interaction
- CPU counters
- Uninitialized memory
- The previous state of the entropy pool
- A built-in hardware random number generator
- Entropy from the Blockstream companion app
Jade Classic and Jade Plus add battery readings and multiple camera images captured during boot, and Classic adds on-die temperature. Before any randomness is used, Jade samples raw radio noise and spends a full second hashing over its own output.
The pool works the way Bitcoin Core's does: SHA-512 over the previous state plus every source, the last 32 bytes becoming the new state, the first 32 returned as the entropy requested and fed to the standard BIP39 recovery-phrase function.
Because everything lands in the same hash, one weak source can't collapse the pool.
Habits That Keep You Safe
Beyond a migration, these are the practices worth keeping permanently:
- Verify every receive address and every send on the Jade screen before approving, no matter what the app or the browser shows.
- Take firmware only from official sources. Any email carrying a firmware update is hostile, whoever the sender appears to be.
- Run Genuine Check when a Jade Plus or Jade Core arrives, before it holds a single sat. Convincing packaging proves nothing; the attestation does.
- Consider adding a BIP-39 passphrase for a second layer on top of your recovery phrase. It's cheap insurance on any device, but introduces important precautions to keep in mind.
- Slow down, stay calm. Scams need you to act before you check. Don’t let them.
Verify Your Way Through It
Bitcoin's promise is that you don't have to trust anyone with your money. Weeks like this one are why that promise matters, and why acting on it is non-negotiable.
Questions during your migration? Reach us through official Blockstream support channels only. We will never DM you first, and we will never ask for your recovery phrase.
- Get a Jade and verify every transaction on the device.
- Read the Jade firmware and hardware yourself. Don’t trust, verify.