TL;DR
A Coldcard Mk4, Mk5 or Q can be one of the keys in a Sparrow multisig, without ever plugging it into the computer: you move files on a microSD card. You import the multisig setup on the Coldcard once, and it remembers it. I don’t use a Coldcard myself; this page follows Coinkite’s and Sparrow’s documentation, checked October 10, 2026. Read the July 2026 seed flaw first.
July 30, 2026: weak seeds on some Coldcards
A firmware bug made some Coldcards generate seeds with far too little randomness. From July 30, 2026, attackers worked those seeds out offline and swept the funds. The devices weren’t hacked; the seeds were weak from the start. A firmware update does not repair a seed that already exists.
If one of your keys was created on an affected Coldcard, treat that seed as known to others and replace it. Details below and in security alerts.
The seed flaw: which devices, and what to do
Coinkite’s advisory (first published July 30, 2026, updated August 1) lists the affected firmware. What counts is the firmware that created the seed, not the version on the device today. BlockSec traced the cause to a build error that left seed generation on a weak software fallback instead of the hardware random number generator.
| Model | Seeds created on | Fixed from |
|---|---|---|
| Mk2, Mk3 | 4.0.1 (March 2021) to 4.1.9 | 4.2.0 |
| Mk4, Mk5 | before 5.6.0 (Edge: before 6.6.0X) | 5.6.0 / 6.6.0X |
| Q | before 1.5.0Q (Edge: before 6.6.0QX) | 1.5.0Q / 6.6.0QX |
Coinkite says the Mk4, Mk5 and Q seeds have about 72 bits of randomness instead of 128: “not as severe” as on the Mk2 and Mk3, “but still serious”. Standard and Edge are separate release tracks; a higher Edge number doesn’t mean it’s fixed.
Coinkite names two partial exceptions. A seed made with at least 50 private, independent dice rolls added isn’t at risk from this bug alone. A strong, unique passphrase adds a barrier, but Coinkite still says to migrate. If you’re not certain how a seed was made, treat it as affected.
What I’d do in a multisig:
- Update the Coldcard to fixed firmware, or use a different device, and create a completely new seed.
- Build a new wallet with the new key in place of the old one, back it up and test it (steps 6 to 10).
- Send a small amount first, then move everything. Moving to a new multisig walks through it.
In a 2-of-3, one exposed key isn’t enough for a thief, so you can do this calmly. But your safety margin is gone until the key is replaced. It’s also the best argument for three different brands: a flaw like this hit one key, not all three.
What a Coldcard does in a Sparrow multisig
The Coldcard is built to work air-gapped. You power it from a battery pack or wall charger and carry data on a microSD card. The Q also reads QR codes. A USB connection to Sparrow is possible too.
Like the BitBox02, it stores your multisig. You import the setup file once; after that it shows addresses and checks change outputs against your own setup. By default, once a multisig is stored, it only signs for setups it already knows (the Trust PSBT? setting moves to Verify Only). That makes a Coldcard a strong address check, once imported.
What you need
- A Coldcard Mk4, Mk5 or Q on fixed firmware
- A microSD card and a card reader for your signing computer
- Sparrow on your signing computer (step 3)
- Optional: a six-sided die, for extra entropy when creating the seed
Steps
- Check the firmware. Sparrow’s guide uses Advanced > Upgrade > Show Version. Update if it’s below the fixed version in the table. Download the firmware from Coinkite, check it in Sparrow with Tools > Verify Download, copy it to the microSD card and install it from the card.
- Create the seed. Choose New Wallet, add dice rolls if you like, and write the 24 words on paper. The seed rules from step 4 apply.
- Export the public key. Insert the card and choose Advanced/Tools > Export Wallet > Sparrow Wallet (older firmware: Settings > Multisig Wallets > Export XPUB), account 0.
- Import into Sparrow. In a keystore tab of the multisig wallet, click Airgapped Hardware Wallet, find Coldcard and choose Import File…. Check the path m/48’/0’/0’/2′ and the master fingerprint.
- Send the setup back. When all three keys are in and you’ve clicked Apply, use Export… on the Settings tab and pick Coldcard Multisig. Save the file to the card (or show it as a QR code for the Q).
- Import it on the Coldcard. Settings > Multisig Wallets > Import. It shows the details before you accept: check 2 of 3, P2WSH, the path and the three fingerprints.
- Check an address. Use the Address Explorer on the Coldcard. Multisig addresses are partly hidden by default; switch Full Address View on in the Multisig Wallets menu to see all of it.
- Sign. In Sparrow, click Finalize Transaction for Signing, then Save Transaction to the card. On the Coldcard choose Ready To Sign, check the address and amount, sign, and bring the signed file back with Load Transaction.
Quirks
- Short names. The Coldcard allows 20 characters for the wallet name; Sparrow shortens longer names in the export.
- Passphrase. A passphrase on the Coldcard opens a different wallet and shows a new fingerprint. Apply it before you export the key and before every signing, and compare the fingerprint with your notes.
- Rebuilt in Sparrow? The Coldcard keeps its own copy, so a rebuilt Sparrow wallet still matches as long as the descriptor is the same.
Buying
New units ship with corrected firmware, according to Coinkite’s shop; still update on arrival. Buy only from the Coinkite shop, never a reseller or second-hand (why). On October 10, 2026 the shop listed the Mk5 at $219 and the Q at $319, both marked down; prices change. There’s no affiliate link here.
Common mistakes
- Keeping a seed made on affected firmware because the device is updated now.
- Generating a new seed before installing the fixed firmware.
- Forgetting to import the setup file on the Coldcard, so it can’t verify addresses.
- Checking only the visible part of a partly hidden address.