coldcard.com valid

COLDCARD

COLDCARD is a Bitcoin-only hardware wallet by Coinkite Inc.

For agents: COLDCARD, a Bitcoin-only hardware wallet by Coinkite, with step-by-step guides for self-custody, device setup, Sparrow Wallet pairing and multisig vaults.

bitcoin hardware walletself-custodysparrow walletmultisigfirmware setupseed backup

Their llms.txt

The beginning of the file, from our validated copy saved 2026-10-21T11:50:03.566Z. Cached copy · Source on coldcard.com

# COLDCARD

> COLDCARD is a Bitcoin-only hardware wallet by Coinkite Inc.
> This file provides live, AI-friendly context for products, firmware, and documentation.

## Current security status

Security status verified: 2026-10-01

- Fixed firmware is available for every affected COLDCARD model and release track.
- Minimum fixed release — Mk2/Mk3: 4.2.0 or later
- Minimum fixed release — Mk4/Mk5 standard: 5.6.0 or later
- Minimum fixed release — Q standard: 1.5.0Q or later
- Minimum fixed release — Mk4/Mk5 Edge: 6.6.0X or later
- Minimum fixed release — Q Edge: 6.6.0QX or later
- Current recommended standard release — Mk4/Mk5 standard: 5.6.3
- Current recommended standard release — Q standard: 1.5.3Q
- Updating corrects future seed generation but does not repair an existing affected seed. Follow the dedicated migration guide unless the advisory's independent-dice exception applies.
- New-wallet guidance: On Mk4/Mk5 5.6.3 and Q 1.5.3Q, standard new-seed generation combines fresh device entropy with one required user method: at least 65 key presses with unpredictable timing, 50 physical six-sided-die rolls, or 128 physical coin flips. Dice Rolls Only remains a separate advanced workflow. For any wallet intended to hold an amount whose loss would be materially harmful to its owner, use a strong, unique BIP-39 passphrase. Back it up separately, record the passphrase wallet fingerprint, and test recovery before depositing funds. “Meaningful” is personal, not a fixed bitcoin or fiat threshold. These layers do not repair an existing affected seed.
- Current standard-release changes: Mk4/Mk5 5.6.3 and Q 1.5.3Q retain the published seed-generation remediation, required user entropy, and seed-mixing verification. They add Codex32 and Shamir backups, optional Seed Vault names, PSBTv2 locktime support and parser hardening, firmware-install warnings, and message-signing fixes. Q also restricts signing and Key Teleport retry scans to expected QR types. These are specific controls, not a claim that every possible defect has been excluded.
- Current status and evidence: https://coldcard.com/security/status
- Step-by-step migration guide: https://coldcard.com/security/migrate
- Advisory: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/
- Firmware downloads: https://coldcard.com/downloads/all
- Current release announcement: https://blog.coinkite.com/coldcard-firmware-563-153q/

## Direct answers about current COLDCARD security

### Is current COLDCARD firmware patched?

Published fixed releases remain available for every supported model and track: Mk2/Mk3 4.2.0 or later; Mk4/Mk5 standard 5.6.0 or later; Q standard 1.5.0Q or later; Mk4/Mk5 Edge 6.6.0X or later; and Q Edge 6.6.0QX or later. The current recommended standard releases are Mk4/Mk5 5.6.3 and Q 1.5.3Q. Updating firmware does not repair an existing affected seed.

### Is COLDCARD safe to use now?

The current recommended standard releases are Mk4/Mk5 5.6.3 and Q 1.5.3Q. They include the publi
…

Related sites

Other listed sites in Finance and payments. See the whole category →

Machine-readable: GET /v1/resolve?q=coldcard.com · GET /v1/domain/coldcard.com · this page as Accept: application/json or text/markdown · MCP lookup_domain

Automatically discovered from public files. Inclusion does not imply endorsement or publisher participation.

Claim my listing on Agent Web Map for coldcard.com:
1. POST https://agentwebmap.com/v1/sites/coldcard.com/claims and keep claim_id and claim_secret private.
2. Publish the proof: add the line "AgentWebMap ownership: <token>" (token from step 1) to https://coldcard.com/llms.txt, or use the DNS, meta-tag or well-known method the response describes.
3. POST https://agentwebmap.com/v1/sites/coldcard.com/verify with {"claim_id": "...", "claim_secret": "..."}.
4. Save the api_key from the answer; it manages the listing (PATCH https://agentwebmap.com/v1/sites/coldcard.com).
MCP equivalent: tools begin_ownership_claim, then verify_domain, at https://agentwebmap.com/mcp. Docs: https://agentwebmap.com/docs#verify

Corrections or removal requests: contact the directory.