Affiliate disclosure: buying through links on this page may earn us a commission at no extra cost to you (details). Nothing here is investment advice.
Verdict up front — and we won’t bury the lede: the Coldcard Mk4 is the bitcoin-only workhorse this site has recommended for years, and five days before this review published, it suffered the worst incident in its history — a firmware RNG bug that let attackers drain wallets remotely (see our Security Incident Log). The patch (5.6.0) shipped fast and the details were disclosed plainly. So this review answers the question that actually matters right now: knowing what just happened, would we still buy one? Short answer: yes, on patched firmware, with eyes open — and here’s the long answer.
Check current Coldcard Mk4 price →
Quick specs
| Price | ~$157 (Coinkite, made in Canada) |
| Focus | Bitcoin-only — no altcoin code, ever, by philosophy |
| Security chips | Dual secure elements from two different vendors — a compromise of one doesn’t expose the seed |
| Data paths | Your choice of ceremony: fully air-gapped via microSD (PSBT), NFC tap, or USB-C for the less paranoid |
| Interface | Numeric keypad + compact OLED — the calculator aesthetic is the brand |
| The tricks | Duress PIN (opens a decoy wallet) · Brick-Me PIN (destroys the device) · anti-phishing words · login countdown · Seed XOR splitting |
| Firmware | Source-viewable but restrictively licensed (not OSI open source) — you can read it; competitors can’t ship it |
| Our verifiability score | 6 / 10 — methodology (track-record pillar under active observation after July 2026) |
The July 2026 incident, addressed first
A firmware bug caused affected Coldcards to silently bypass their hardware random number generator, generating weak keys that attackers brute-forced remotely — roughly 594 BTC drained before the patch. No physical access needed, no user error involved. It was the nightmare scenario for the exact device class that promises the opposite, and it happened to the brand with the most security swagger in the industry.
Two things are simultaneously true. First: this was a genuine failure that cost real people real bitcoin, and no amount of duress-PIN cleverness offsets a broken RNG — randomness is the foundation everything else stands on. Second: the response was what you’d want — a fast patch (5.6.0 / 1.5.0Q), a plain-language advisory telling affected users to treat old seeds as compromised, and no minimizing. Our methodology scores “track record and disclosure” as one pillar precisely because incidents are inevitable and honesty about them isn’t. Coinkite’s disclosure conduct kept this from being disqualifying; the incident itself keeps us from pretending nothing happened.
If you buy a Mk4 today: verify firmware is 5.6.0 or later before generating anything (Settings → Advanced → Upgrade shows the version; new stock ships patched). If you own one and generated your seed on affected firmware, the advisory is blunt: move funds to a fresh seed made on patched firmware. And as always — never buy from marketplace resellers, doubly so now.
What the Mk4 still does better than almost anyone
The Mk4’s genius has always been paranoia-as-a-feature-set. The duress PIN opens a convincing decoy wallet for coerced unlocks. The Brick-Me PIN destroys the device on command. Anti-phishing words prove the device wasn’t swapped. Seed XOR splits a backup into pieces that are individually useless (a manual cousin of the Cypherock’s automated approach). Dual secure elements from two vendors mean no single chip supplier is a single point of failure — the same multi-vendor logic the Safe 7 arrived at years later. And the bitcoin-only firmware philosophy shrinks the attack surface to one chain, one job. For multisig, it remains a first-class Sparrow/Nunchuk citizen and the default hardware cosigner of the sovereignty crowd.
The honest drawbacks (beyond the obvious one)
- The learning cliff. The Mk4 assumes you know what a PSBT is and why you’d want one. Beginners drown; that’s what our Safe 3 recommendation is for.
- Tiny screen, keypad-only. Address verification on a small OLED is squint-work — it’s the main reason the Coldcard Q exists.
- “Source-viewable” isn’t open source. You can audit the code but the license restricts reuse — worth 2/3 on our openness pillar, not 3/3, and reproducible builds are partial.
- Premium pricing for spartan hardware. ~$157 buys security engineering, not screens or metal — a Keystone gives more device per dollar if bitcoin-only isn’t your religion.
Mk4 or Q?
Same brain, different bodies. The Q (~$249) adds a big screen, full QWERTY, battery power, and a camera for QR-based air-gap — the flagship experience. The Mk4 is the compact veteran: cheaper, pocketable, microSD-ceremony. Both took the July 2026 hit and both are patched. Buy the Q for daily-driver comfort and QR workflows; buy the Mk4 as the classic multisig cosigner and safe-drawer vault. Full grid on the comparison table.
FAQ
Is it actually safe to buy after July 2026?
Current stock ships patched, and the flaw is fixed, not mitigated. The rational read: the RNG path now has more eyes on it than any wallet component in the industry. The irrational read — “incidents mean never again” — would also disqualify Ledger (2020, 2023) and, eventually, everyone. Judge makers by their response; this one responded well.
Should I use dice rolls instead of the RNG?
The Mk4 supports dice-roll seed generation — after July, it went from party trick to genuinely reasonable practice for large holdings. Fifty rolls of a casino die and the RNG question leaves the building entirely.
Can I run it forever air-gapped?
Yes — microSD-only from unboxing to grave; USB can carry power alone and NFC can stay off. It’s the cheapest true always-air-gapped workflow from an established maker.
Bottom line
The Mk4 remains the most security-dense bitcoin-only device per cubic centimeter — and July 2026 is now permanently part of its story. We recommend it the way experienced bitcoiners hold it: on patched firmware, with dice-rolled seeds for serious sums, and with the humility the whole industry just re-learned. Trust, but verify — the device’s own motto, applied to the device.
Get the Coldcard Mk4 at coldcard.com (~$157) → Always buy direct from the manufacturer — never marketplace resellers.