Comparison
COLDCARD vs Trezor (2026)
7 min read
| COLDCARD Mk4 / Mk5 / Q | Trezor Safe 3 / 5 / 7 | |
|---|---|---|
| Our status | Advanced only, new seeds only | Recommended, PIN always set |
| Minimum firmware | Current 5.6.3 / 1.5.3Q (fix first shipped in 5.6.0 / 1.5.0Q) | 2.12.5+ |
| 2026 events | Weak-seed RNG flaw; thefts from July 30, 2026 | Several issues fixed in current firmware |
COLDCARD in 2026
A firmware random-number error produced weak seeds that attackers brute-forced offline. Galaxy Research tallied 1,778.84 BTC in high-confidence losses by August 14, 2026 (Galaxy). Updating firmware does not fix an existing seed; Coinkite's guidance is to create a new seed on fixed firmware and move funds (COLDCARD migration).
Trezor in 2026
Trezor disclosed and fixed a multisig verification bug and a lock bypass in an SD-protect-only configuration, among others (Trezor; Trezor). Always set a PIN and stay on current firmware.
Which should you pick?
- First device, want it simple: Trezor Safe (or BitBox02 / Jade).
- Experienced and comfortable with advanced settings: COLDCARD on current firmware with a freshly generated seed, ideally as one key in a multisig with a different vendor.
- Either way: buy direct, verify firmware on the screen, and run a restore test.
Sources
Educational content only, not financial advice. See our disclosure.