firmware update

Ledger

2026-08-27 03:07:00

Ledger says Ethereum app flaw was patched, users protected after firmware and app updates

Ledger Chief Technology Officer Charles Guillemet said the company’s Ethereum app did previously have a vulnerability tied to parts of the Clear Signing process, but the issue has already been fixed and deployed. According to Guillemet, the flaw was identified by Donjon, Ledger’s internal security research team, using an AI-driven vulnerability research tool, and the remediation was completed two weeks ago. He also said a smart contract security company that recently claimed to have found the bug only contacted Ledger’s bug bounty program after the fix had already been completed. Guillemet said that firm did not follow a responsible disclosure process, did not communicate with the bug bounty team, and later published material suggesting the issue was still unresolved. He added that users who promptly update their Ledger device firmware, the Ledger app, and related software will receive the latest security protections. The statement addresses recent claims around the Ethereum app and frames the issue as already remediated for users who install the available updates.

940

Ngrave

2026-08-26 15:09:45

Ngrave rolls out ZERO firmware 1.8 with open-source universal QR protocol

Hardware wallet maker Ngrave has released firmware version 1.8 for its ZERO wallet, according to a Techub News brief citing Cointelegraph. The update brings in an open-source universal QR protocol and moves wallet synchronization and transaction signing to that standard. Ngrave also added support for Polygon network tokens in the new release. Alongside those changes, the firmware includes fingerprint recognition and stability improvements. The announcement centers on product functionality rather than market impact, with the source note focusing on the features included in the update. No additional rollout details, user numbers, or timing beyond the release notice were disclosed in the item.

900

Coldcard

2026-08-24 09:14:47

Coldcard firmware update mandates dice rolls or coin flips after seed-generation failure

Coinkite has released new firmware for its Coldcard hardware wallets three weeks after disclosing a seed-generation failure tied to bitcoin thefts exceeding $114 million. The update changes how new wallet seeds are created by requiring user-supplied entropy, either through at least 65 unpredictably timed key presses, 50 rolls of a physical six-sided die, or 128 coin flips. The company also replaced its backup random number generator, moving from Yasmarang to a SHA-256-based design. Coinkite said the review behind the release was assisted by AI tools, including Kimi and other frontier models, and covered the broader system rather than only the randomness bug. That review surfaced additional issues in transaction approval, USB data handling, and firmware update validation. The new firmware now re-checks a staged transaction immediately before signing, and blocks by default signature modes that leave later outputs editable. The company said users who created seeds on affected firmware between 2021 and July 2026 still need to generate a new seed on fixed firmware and move their funds. Installing the update alone does not secure an already compromised wallet. Coinkite also launched a public security status page with fixed-release information and migration guidance, while law enforcement continues to investigate the thefts.

1210

Coldcard

2026-08-22 09:21:08

Coldcard attack tied to seed-generation flaw, Coinkite urges firmware upgrade

Techub News said Coinkite, the developer behind the Bitcoin wallet Coldcard, shared new details on Aug. 20 about an asset outflow disclosed on July 30, 2026, and strongly advised users of the Mk4, Mk5 and Q models to upgrade their firmware immediately. Coinkite said the attack stemmed from a seed-generation vulnerability and that law enforcement is still investigating. Galaxy Research data put total losses at more than $110 million, making it the third-largest crypto theft of 2026. Coinkite also said the new firmware cannot make already compromised seeds safe, and users need to move funds to wallets created with new seeds.

1520

Coldcard

2026-08-21 12:10:55

Coldcard ships firmware after bitcoin theft, says AI helped find more bugs

Coldcard has shipped a firmware update after a three-week review that followed a bitcoin theft. The company said the review uncovered problems unrelated to the flaw that cost users $114 million. It also said the update does not make a compromised wallet safe again, and that AI helped surface additional bugs during the process.

1130

Coldcard

2026-08-20 15:27:45

Coldcard releases new firmware to tighten security and asks affected users to regenerate seed phrases and move funds

BlockBeats reported on Aug. 20 that Coldcard has released firmware 5.6.1 for Mk4/Mk5 devices and 1.5.1Q for Q devices. The update follows an emergency fix on July 31 and three weeks of security review, with the main focus on risks tied to a prior seed-phrase generation attack. Coldcard says each newly generated seed phrase must now include at least one user entropy source, and affected users should update first, generate and verify a new seed phrase, then migrate funds to a new wallet. The company also urged Mk4, Mk5 and Q users to verify the firmware signature before installing the update.

1490

Coldcard

2026-08-20 15:28:53

Coldcard rolls out new firmware after mnemonic generation security review

Coldcard has released firmware 5.6.1 for Mk4 and Mk5 devices and version 1.5.1Q for the Q model, following a three-week security review after an emergency fix. The update is aimed at reducing the risk tied to a previously disclosed mnemonic-generation attack. Under the new rules, every newly generated seed phrase must include at least one source of user-provided entropy, either through at least 65 irregular key presses, 50 physical dice rolls, or 128 physical coin flips. That input is then combined with fresh entropy from STM32 TRNG, SE1, and SE2. The firmware also adds staged PSBT verification immediately before signing, tightens USB connection and firmware-update boundaries, improves Delta Mode isolation, fixes an active wallet backup issue, strengthens random number generator initialization and fault checks, and changes the default SIGHASH setting. Coldcard said the release is meant to cut the risk of device compromise. The company also warned that updating firmware does not repair seed phrases created by affected older firmware. Users covered by the security notice are advised to update first, generate and verify a new mnemonic, then move funds to a new wallet. Coldcard recommended that all Mk4, Mk5, and Q users update promptly and verify firmware signatures before installation.

1340

Coldcard

2026-08-02 21:32:57

Coldcard theft tally rises to 1,359.882 BTC as attacker-linked address receives 10% laundering offer

The amount of bitcoin tied to the Coldcard security incident has risen to about 1,359.882 BTC, according to figures tracked by the Coldcard Sweep Watch dashboard. The data shows that most of the identified funds remain parked in a small number of addresses controlled by the attacker. On Aug. 1, one of those holding addresses received a transaction carrying an OP_RETURN message. The message openly offered services to "clean" the stolen bitcoin for a 10% fee, assist with KYC, and cash out the proceeds, while also providing a Telegram contact. Coinkite, the hardware wallet maker behind Coldcard, has released an emergency firmware update to address the weak random number generation issue that caused the vulnerability. The company said the new firmware can protect only wallets created in the future and cannot repair seeds that were already generated on affected versions. Some users have also reported device problems after installing the update, including units stuck on an error screen, failure to boot, or suspected bricking. Reports have mainly involved Mk4 and Q devices, with some Mk3 users describing similar issues. As of Aug. 2, Coinkite had not publicly confirmed any widespread firmware defect.

1890