Security alert · 30 Jul 2026: a seed-generation flaw in Coldcard devices was disclosed. What to do →

Receive address doesn’t match the device screen

TL;DR

Don’t send anything to either address. Usually it’s a wrong passphrase, the wrong wallet or a wrong derivation path. If none of those explain it, assume the computer is compromised.

Check the harmless causes first

  1. Did you unlock the passphrase wallet? A device without the passphrase has different keys. On a Ledger, check you used the second PIN.
  2. Is the right wallet open in Sparrow? With two vaults on the same devices, it’s easy to show an address from the other one.
  3. Is the device registered for this wallet? The BitBox02 and the Ledger check addresses against a registration; re-register if in doubt.
  4. Compare the master fingerprints in Sparrow with your notes. A different fingerprint means a different seed or passphrase: see master fingerprint explained.

If it still doesn’t match

Treat the computer as compromised. Malware can show a false address in Sparrow, or give the device a false wallet setup. Follow signing laptop infected: reinstall, rebuild from your descriptor, and check again on a device that has your multisig registered.

Why the device wins

A hardware wallet with your multisig registered calculates the address from keys it has stored or confirmed itself. Your computer can’t change that. That’s why the guide asks you to check addresses on those devices before sending money to them (step 8).

Pasted address changed?

If an address you pasted into an exchange differs from what the device shows, clipboard malware may be swapping it. Don’t send. Clean the computer first.