Fact-check findings
What an automated fact-checker found when it re-read Coldcard Firmware Vulnerability (Standalone Investigation) against the sources the page cites. Only the most recent review is shown.
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
1 claimThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #1[disputed][awaiting moderator]in the timeline
“2026-08-01”
reviewerFirmware 5.6.1 / 1.5.1Q was released on 2026-08-015.6.1 came about three weeks after the July 31 patch, as the page's own Official Response section says. The Aug 1 timeline date contradicts that and the source.Proposed correction (not yet applied)2026-08-20
unverifiable
2 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #6[unverifiable][awaiting moderator]in section: Threat Actor Attribution
“combines this with multiple hardware entropy sources through double SHA-256 mixing”
reviewer5.6.1 features (65 keypresses/50 dice/128 coin flips, double SHA-256, boot check, pre-signing verification)Other 5.6.1 features (user entropy, boot TRNG check, PSBT re-verification) are supported; the double SHA-256 detail was not found in the fetched summary. - #7[unverifiable][awaiting moderator]in section: Attack Timeline and Financial Losses
“identified a high-confidence total of approximately 1,789 BTC stolen from 8,865 addresses, worth approximately $114.7 million at time of theft”
reviewerGalaxy final totals: 1,789 BTC from 8,865 addresses, ~$114.7MSource returned 403. Headline is consistent with the figures. Intermediate Galaxy totals in search (1,778 BTC on Aug 14) are consistent with growth to 1,789.
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #4[partially supported][awaiting moderator]in section: Affected Devices and Firmware Versions
“The flaw is mitigated if the user added at least 50 independent, private dice rolls when initially creating the seed, or if the wallet is protected by a strong, unique BIP-39 passphrase that was not itself generated by the vulnerable device.”
reviewerDice and passphrase mitigation conditionsPage presents the passphrase as an equal mitigation; Coinkite treats it as a weaker barrier and still recommends migration. - #8[partially supported][awaiting moderator]in section: Attack Timeline and Financial Losses
“The exploit began on July 30, 2026.”
reviewerWave One 594 BTC in ~25 minutes on July 30Headline consistent; exact 2:14 AM UTC time not independently checked. Not fetched in detail.
confirmed
4 claimsThe cited evidence supports the claim as written.
- #2[confirmed][no action needed]in section: Threat Actor Attribution
“A subsequent update, version 5.6.1 / 1.5.1Q, was released approximately three weeks later with additional hardening measures.”
reviewer5.6.1 was released approximately three weeks after the emergency patchJuly 31 to Aug 20 is about 3 weeks. - #3[confirmed][no action needed]in section: Affected Devices and Firmware Versions
“Mk2 and Mk3 devices running versions 4.0.1 through 4.1.9 inclusive; Mk4 and Mk5 devices running any version before 5.6.0 (standard) or 6.6.0X (Edge builds); and Q model devices running any version before 1.5.0Q (standard) or 6.6.0QX (Edge builds).”
reviewerAffected firmware ranges and fixed versions per Coinkite advisoryMatches advisory. - #5[confirmed][no action needed]in section: Threat Actor Attribution
“Emergency patched firmware was released on July 31, 2026.”
reviewerEmergency patched firmware released July 31, 2026The cited advisory has no explicit patch date, but Coinkite's firmware page does. - #9[confirmed][no action needed]in section: Attack Timeline and Financial Losses
“this claim has not been independently verified by a Tier 1 source”
reviewerBitcoin Magazine AI claim flagged as unverifiedAppropriately hedged. Note the quote appears in sections[3] (Threat Actor Attribution), not sections[2].