A security warning for COLDCARD users

Amber is not affected by the recently discovered vulnerability of hardware wallet vendor Coinkite. Amber customer funds are secured by geographically distributed, multi-vendor multi-sig in cold storage.

If you use a COLDCARD, or send Bitcoin to one, please read on.

What happened

Coinkite has disclosed a firmware bug that caused some of its COLDCARD devices to create wallet backups (known as seed phrases) with far less randomness than they should have. This vulnerability could make an affected wallet easier for a sophisticated attacker to break into.

The investigation is ongoing.

Until you have checked Coinkite’s advisory, treat any seed phrase created on a COLDCARD as potentially affected. Independent security researchers have confirmed the problem, and there are reports of Bitcoin being taken from affected wallets.

Who may be at risk

Be aware this is a developing situation. Your risk is highest if all of the following are true:

  • Your seed phrase was generated on a COLDCARD.
  • You let the device create it, with no dice rolls added by you.
  • You did not use a passphrase (a separate secret, not your PIN).
  • Your Bitcoin is in a single wallet with one key, not a multi-signature setup.

If only some of these apply, your risk is lower. If you are unsure, it is safest to treat the wallet as affected.

What to do

Coinkite is updating the public as the situation develops, through social media and blog posts:

https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/

We suggest you act promptly, but stay calm and proceed with caution. Reach out to us if you are unsure.

If you send Bitcoin to a COLDCARD

Please do not send more Bitcoin to an affected wallet until you have safely created a replacement. Any scheduled sends or pending Bitcoin withdrawals on their way to a COLDCARD wallet should be paused or cancelled.

Watch out for scams

Amber will never ask for your seed phrase.

Never type it into a website, share it with anyone who calls or messages you, or accept help from a stranger who contacts you about this. Security warnings like this are often used by scammers.

If you know someone who uses a COLDCARD, please share Coinkite’s official advisory with them.

And, as always, our entire team is here to help you — especially if you are one of the affected users.

Kind regards,
Amber Team

‍

Your #1 Bitcoin App