ChainCatcher 消息，Coldcard 发布最新固件 5.6.1（Mk4/Mk5）和 1.5.1Q（Q）。此次更新基于紧急修复后持续三周的安全审查，重点应对此前助记词生成攻击带来的安全风险。新生成的每个助记词必须加入至少一种用户熵源，包括不规律按键至少 65 次、实体骰子投掷 50 次或实体硬币抛掷 128 次，并与 STM32 TRNG、SE1 和 SE2 提供的新鲜熵进行组合。
新固件还增加签名前即时分阶段 PSBT 验证，强化 USB 连接及固件更新边界，改善 Delta Mode 隔离机制，修复活跃钱包备份问题，加强随机数生成器初始化及故障检查，调整 SIGHASH 默认设置，并包含多项安全性和正确性改进。Coldcard 表示，此次更新旨在进一步降低设备遭受攻击的风险。
官方提醒，更新固件无法修复此前受影响固件生成的已有助记词。若用户的助记词属于此次安全公告涉及范围，应先更新设备，再生成并验证全新的助记词，并将资金迁移至新钱包。Coldcard 建议所有 Mk4、Mk5 和 Q 用户及时更新设备，并核验所下载固件的签名。
Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.