Coldcard (Coinkite)
UNDER REVIEW · NOT SCOREDColdcard does not currently carry a LISR score. It has entered the wallet assessment pipeline. This notice records the date the review was opened and the reason, so that the eventual score carries a visible provenance rather than appearing without context.
Still not scored. The device-level facts a rating requires have largely settled. The outstanding item is Coinkite’s own formal technical review, which the company has stated is forthcoming. Linkmerica is waiting for that document rather than for the incident to end.
What has stabilised. Coinkite has confirmed the root cause as a March 2021 build configuration error that caused seed generation to fall back to a software random number generator instead of the device’s hardware source. Affected firmware is now enumerated by model and version, and that scope has not changed since August 1. Fixed firmware has been released for every affected model and release track. Coinkite has identified other products in its range as running different software and unaffected. Refer to Coinkite’s advisory for the current model and firmware guidance.
What has not. Reported losses have continued to rise across multiple waves and remain under active on-chain analysis by third parties. Those figures describe the scale of the incident rather than a property of the device, and are not an input to a LISR score. A rating assesses custody risk characteristics, not loss totals.
Why this distinction matters. A score published on July 31 would have required revision within days as the affected-device scope widened. A score published today would rest on an analysis its own manufacturer describes as preliminary. Neither is an assessment; both would be a reaction to a news cycle. The review remains open.
Why the review was opened
On July 30, 2026, a large volume of Bitcoin was swept from single-signature addresses in a narrow window, reported by on-chain analysts. Coinkite subsequently issued a security advisory concerning seed entropy generation on affected Coldcard firmware and published a technical backgrounder. Independent technical analysis has been published by Block's Bitkey team and by Galaxy Research. The reported figures have been revised upward repeatedly as analysis has continued; refer to those sources for current numbers.
Coinkite has stated that its investigation is ongoing and has not confirmed that the entropy issue caused the observed movement of funds. Security researchers have identified it as the most plausible explanation. Linkmerica records that distinction rather than collapsing it.
For affected firmware versions and device models, refer to Coinkite's own advisory and technical backgrounder. That scope has been revised during the disclosure and is the vendor's to state, not ours to restate.
Why no score is being published today
A LISR score is a deterministic assessment produced under a versioned methodology against a stable evidence base. Coinkite's investigation is ongoing, the scope of affected devices has been revised upward since initial disclosure, and the loss figures have moved substantially within 48 hours. Publishing a score against facts still in motion would produce a number that reflects a news cycle rather than an assessment, and would already require correction.
The review will complete when the evidence base is stable. The score, when published, will be dated, versioned, hash-verified, and will reference the disclosure that opened this review. Linkmerica scores move in both directions on evidence: one hardware wallet's risk rating was raised within 48 hours of an unpatchable fault-injection disclosure this month, and another's was lowered when the manufacturer shipped production post-quantum firmware.
Follow Coinkite's official guidance directly. Linkmerica does not publish operational security instructions, and will never ask any user for a seed phrase, private key, or wallet access under any circumstances.
Linkmerica is a trade name of CASPO LLC. LISR scores and research are for informational purposes only and do not constitute financial or investment advice. This notice is based on publicly available information as of July 31, 2026.