Clean Wallet
A guided migration companion for non-technical Bitcoin holders who used a Coldcard Mk4 between late 2024 and the patched firmware — it checks your wallet's seed history and walks you safely to a new, properly-generated wallet.
Bitcoin holders who generated a wallet on a Coldcard during the vulnerable firmware window
- Step-by-step check that uses public firmware version and seed-metadata signals to estimate whether a given wallet was generated with weak entropy
- Plain-language migration plan: how to move funds to a freshly-generated wallet without exposing keys online
- Passphrase and backup checklist that verifies your metal seed backup still matches the wallet you're rotating away from
- Optional air-gapped verification using a second device for users who want extra confidence
The Coldcard weak-RNG bug is actively being exploited and Bitcoiners' funds are being stolen; Hacker News discussion is intense and many affected users are not engineers and need a calm, guided path to safety.
Coldcard weak-RNG flaw is confirmed and exploited: Galaxy Research tied a 1,196-address sweep of ~$70.2M (1,082 BTC) on July 30 to the firmware bug, with ~500 wallets already drained per BeInCrypto. Mk4/Mk5/Q pre-fix firmware users form a real, urgent addressable pool, though many are filtered out by the 50-dice-roll or strong-passphrase exemptions.Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft ↗Coldcard Bitcoin Theft Ongoing: Is Your Wallet Affected? ↗
Coinkite publishes a detailed but technical migration advisory (firmware version checks, dice-roll exemptions, single-device swap dance). No polished, consumer-facing 'guided companion' product surfaced; community coverage leans on Gridinsoft and news write-ups, leaving room for a calmer UI layer.Coldcard Security Advisory | COINKITE Blog ↗Coldcard Seed Flaw: Firmware Fix and Safe Migration ↗
Target users are price-sensitive Bitcoiners who expect free/open-source tooling (Sparrow, Electrum, Coinkite docs are all gratis). The migration is one-time per user and Coinkite has already published free official guidance, capping what a paid wrapper can charge — likely $20-50 one-shot at best, weak recurring potential.Coldcard Security Advisory | COINKITE Blog ↗Home - COLDCARD Documentation ↗
Pure event-driven demand: once affected users migrate to fixed firmware or new wallets, the TAM collapses to zero. No recurring trigger; the addressable pool shrinks daily as funds move or get swept.Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft ↗
Buildable as a desktop/offline wrapper that checks firmware version, applies the dice/passphrase exemption logic, and walks the user through Coinkite's documented seed-swap steps. Main risk is handling secret material (seed words, passphrases) safely; an air-gapped open-source build is doable but must be security-audited to be trusted.Coldcard Security Advisory | COINKITE Blog ↗Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmware ↗