Coinkite says the affected generator produced about 72 bits of entropy on Mk4, Mk5 and Q instead of the expected 128 bits. On Mk2 and Mk3, firmware 4.0.1 through 4.1.9 is in scope. Less entropy narrows the space an attacker must search; it does not mean every affected wallet is already compromised.
The defect lives in old keys
Two independent protections change the immediate risk assessment. At least 50 fair, private dice rolls supplied enough independent entropy under the affected implementation, according to the advisory. A strong, unique BIP-39 passphrase adds another barrier, but the company still recommends migration because neither case repairs the underlying seed.
Affected firmware and corrected releases
| Device track | Affected | Generate new seeds only on |
|---|---|---|
| Mk2 / Mk3 | 4.0.1–4.1.9 | 4.2.0+ |
| Mk4 / Mk5 Standard | Before 5.6.0 | 5.6.0+ |
| Q Standard | Before 1.5.0Q | 1.5.0Q+ |
| Mk4 / Mk5 Edge | Before 6.6.0X | 6.6.0X+ |
| Q Edge | Before 6.6.0QX | 6.6.0QX+ |
A safer migration sequence
- Verify the old wallet
Confirm the written backup and fingerprint before changing device state.
- Install the correct fixed track
Standard and Edge versions are not interchangeable.
- Create and verify a new seed
Record the backup and confirm a receiving address on-device.
- Test before moving the balance
Send a small transaction, verify receipt, then move the remainder.
Three mistakes that increase risk
Updating and stopping
New firmware does not strengthen the old seed.
Typing the seed online
The advisory says not to enter recovery words or passphrases into websites or untrusted devices.
Moving everything at once
A small verified test reduces the chance that migration error becomes the immediate loss.
| Affected range | Fixed release | |
|---|---|---|
| Mk2 / Mk3 | 4.0.1–4.1.9 | 4.2.0+ |
| Mk4 / Mk5 Standard | Before 5.6.0 | 5.6.0+ |
| Q Standard | Before 1.5.0Q | 1.5.0Q+ |
| Mk4 / Mk5 Edge | Before 6.6.0X | 6.6.0X+ |
| Q Edge | Before 6.6.0QX | 6.6.0QX+ |
Method: Versions are transcribed from Coinkite's August 1 advisory update; Standard and Edge tracks are separate.
Next reporting
- Coinkite's promised formal technical review and any change to the affected-version list.
- Evidence that active theft continues after the migration warning.
- Whether wallet software and custody providers add detection or guided migration support.