Coinkite✓

RT @astuyve: AWWWWOOOOOOOGAAAAAAA 9.8 severity use-after-free vulnerability in the kernel’s IPv4 TCP stack just landed Time to patch!

RT @Gen6G: My top three HWS in order, explained. I intentionally left out DIY to keep this simple so the DIY people don't need to come at me but I respect you 👍 1. COLDCARD Q @Coinkite - My prized possession. I play with the Q all the time, becoming more obsessed as time goes on. The Q immediately makes most other hardware irrelevant IMO considering all the features and functionality, especially not requiring a companion app for initial setup. There really is something special about the full QWERTY keyboard... I have never regretted buying a CC and features are still being added 🐦‍🔥 2. Frostsnap @FrostsnapTech - By far the best multi sig option there is, as SIMPLE as it gets. Perfect when you don't only have yourself to think about as long as they are geographically distributed properly. These devices give me the same excitement as the Q even though I use them much less. You don't have to worry about internal batteries. They appear as single sig regardless of how many are used. The setup, signing and restoration are magical. Seriously love these things... ❄️ 3. Blockstream Jade Plus @BlockstreamJade - I gave Blockstream a hard time for months after the release of the Jade Plus because of my issues with the camera but that was eventually fixed after 2 or 3 firmware updates. The Jade does not actually force you to use an app although most people are probably better off hosting their own oracle when they can for better reliability. I enjoy the simple, small, lightweight form factor while still incorporating some features like a passphrase, BIP 85, OTP, and stateless which most people don't realize is an option. I do occasionally use liquid too so it's great for that. The oracle is not perfect but I respect @Blockstream for doing something different. The alternative theme options scores the Jade some Aura points. I do feel bad for attacking Blockstream so much in the past so hopefully they will appreciate it still being in my top 3 😇

RT @karpuzmining: I joked about CatCard being the “ColdCard x Mt Gox collab” but after spending weeks going down a self custody research rabbit hole I like this more and more especially as part of a multi-vendor/sig setup. @MagicalTux isn’t getting enough credit for this one, but it’s pretty impressive.

RT @TurnerAnalytics: Multi-vendor multi-sig users today having combined each of these gems into a 3-of-5

"the password you are attempting to use was part of a data breach are you sure you want to continue using it?" drone strike my house man i don't care anymore

RT @COLDCARDwallet: A clear case is not decoration. It lets you inspect a COLDCARD for a component swap or implant. The tamper-evident bag, anti-phishing words, dual Secure Elements and verified firmware add independent checks. That’s defense in depth.

RT @COLDCARDwallet: Press 2 at the OK TO SEND? screen to open Transaction Explorer. Step through every input being spent and every destination or change output instead of approving from a summary alone.

RT @add_BTC: I’m still running @COLDCARDwallet What else can people do? there is no peer. Update and roll your dice.

COLDCARD is a Bitcoin-only signing device. It does not require a COLDCARD account or mandatory companion app. Pair it with compatible wallet software and keep the signing key offline.

RT @COLDCARDwallet: COLDCARD now supports #Codex32 Shamir backups for existing BIP-39 and passphrase wallets. Choose your threshold. Same addresses. No coins moved. In 5.6.3 and 1.5.3Q. Save 10% when paying with Bitcoin. Learn more

RT @Schnuartz: I had a look at how many GitHub Stars different Hardware Wallet Projects have.

RT @nvk: Software accumulated a fire debt. Till now the limits of human review let bugs,brittle dependencies and untested assumptions pile up like dry brush. AI security review has now ignited an ecosystem-wide burn. Destructive,but it'll clear the backlog. Software will emerge stronger

Coinkite’s standard data-retention practice is to blank customer records after 120 days, retaining only email and country. Customers can request earlier blanking after delivery. Our August notice explains the current legal-preservation exception:

RT @Coinkite: Authenticity systems have tradeoffs. Remote check is convenient, but concentrate trust & attacker incentives in one key. #COLDCARD chose distributed verification: local checks w/ a clear case, matched bag number, verified firmware & GENUINE|CAUTION LEDs

RT @Coinkite: Keep your seed offline and safe from hacks. Dual secure elements protect every key.

RT @Coinkite: Monday, Oct. 12, 2026 update: We remain locked out of @COLDCARDwallet and are still waiting for @X to restore our access.

We are investigating how a post containing a phishing link was published from this account. It has since been deleted. Do not visit or interact with that link. COLDCARD’s only official website is This account has used offline 2FA with tightly restricted access since 2017. We have contacted @X and are reviewing all account access. We will share further verified updates here.

RT @COLDCARDwallet: COLDCARD is yours to verify, modify, and run. 👨‍💻 Learn how to change the open-source firmware, test it in the simulator, build a development-key DFU for Mk4/Mk5 or Q, and install it on a dedicated device.

RT @COLDCARDwallet: 🚨 New COLDCARD firmware is out: 5.6.2 for Mk4/Mk5 and 1.5.2Q for Q. View TRNG Words is back. We also added an offline tool to verify dice-roll or coin-flip mixing, USB ncry v3, and more transaction, Virtual Disk, firmware and wallet-state fixes. Please update promptly: Full notes:

RT @COLDCARDwallet: How the new COLDCARD seed generation works (MK4/MK5 ≥5.6.1 and Q ≥1.5.1Q): Track the security status here: Explore the interactive tool and source code here:

RT @COLDCARDwallet: 🚨 New COLDCARD firmware is available: 5.6.1 for Mk4/Mk5 and 1.5.1Q for Q. This release follows three weeks of sustained review since our July 31 hotfix. We continue to acknowledge the customers who suffered severe financial losses from the seed-generation attack. Every newly generated seed now requires one source of user entropy: at least 65 key presses with unpredictable timing, 50 physical dice rolls, or 128 physical coin flips. This input is combined with fresh entropy from the STM32 TRNG, SE1, and SE2. The release also adds staged-PSBT verification immediately before signing, stronger USB and firmware-update boundaries, improved Delta Mode isolation, active-wallet backup fixes, stronger RNG initialization and fault checks, safer SIGHASH defaults, and many additional security and correctness improvements. Important: Updating does not repair an existing seed generated on affected firmware. If the advisory applies to your seed, update your device, generate and verify a new seed, then move your funds. We strongly recommend that all Mk4, Mk5, and Q users update and verify the signed firmware download. Thank you to every researcher who reported issues, reproduced edge cases, reviewed fixes, and helped make this release stronger.