Replace weak Coldcard wallet seeds after firmware remediation

A firmware update affects future seed generation but does not strengthen existing Coldcard private keys.

Funds held at old addresses therefore remain exposed until a new seed and signing configuration are active and the funds have moved. The August 17, 2026 synthesis classifies weak Coldcard seeds as requiring decisive containment.

The materials mention 4.0.1, 4.1.9, and 5.6.0, but the missing vendor documents mean operators should obtain authoritative scope guidance without delaying replacement of seeds already identified as potentially affected.

Coldcard Mk3 operators whose seed-generation records mention 4.0.1 or 4.1.9, or otherwise fall within the scope confirmed by authoritative vendor guidance, face the possibility that existing private keys have substantially reduced entropy.

Coldcard Mk4 and Mk5 operators whose generation records relate to the reported 5.6.0 checkpoint require the same vendor-guided scope check; the packet does not independently establish the exact boundary.

Wallet owners who still hold funds at addresses derived from potentially affected seeds remain exposed after a device update because their existing keys do not change.

Multisignature coordinators and custodians using signing descriptors derived from those seeds must replace the affected descriptors and migrate funds.

Operators with contemporaneous proof of at least 50 independent private dice rolls or a strong, unique BIP-39 passphrase may have a different exposure assessment, but undocumented claims do not establish an exception.

Supporting — The custody analysis explains that updating firmware changes only future seed generation and cannot strengthen private keys derived from an existing weak seed. It specifically supports new-seed generation, descriptor replacement, independent address verification, and fund migration.

Supporting — The crypto-fincrime analysis reports reduced entropy for Coldcard Mk3 and Mk4/Mk5 seed generation and names 4.0.1, 4.1.9, and 5.6.0. This supports treating the issue as a seed-compromise problem rather than only a device-patching problem.

Supporting — The final synthesis classifies weak Coldcard seeds as requiring decisive containment and treats replacement and migration as critical.

Evidence gap — The evidence review finds that the vendor advisory and firmware changelog themselves were not recorded. It therefore does not support presenting 4.0.1, 4.1.9, or 5.6.0 as independently verified scope boundaries.

The crypto-fincrime contributor surfaced evidence that Coldcard seed generation had reduced entropy and distinguished existing keys from future seeds generated after remediation.

The decision scout converted that finding into the operational question of whether a firmware update alone was sufficient and concluded that it was not. The evidence review supported generating a new seed, replacing signing descriptors, independently verifying receiving addresses, and moving funds.

It also identified a material gap: the packet mentions 4.0.1, 4.1.9, and 5.6.0 but does not contain the underlying vendor advisory or changelog needed to verify exact boundaries. The boundary reviewer resolved this by retaining the remediation guidance while treating those boundaries as unverified.

The linker found no matching prior record, and the arbiter selected a new operational decision record.