COLDCARD Security Advisory A seed-generation defect affected releases beginning with firmware 4.0.1. Fixed firmware is available. Existing affected seeds still require migration. Check status
COLDCARD logo
Shopping cart Shop

BACKUP FIRST

A backup is not real until recovery works.

Don't discover a bad backup after loss. Write the seed, make it durable, and test recovery while the wallet is still tiny.

Backup docs Quick setup

What to back up

Seed words

The BIP-39 seed restores the wallet. Store it offline, clearly, and preferably on metal. Anyone with the words can spend.

Passphrase for a meaningful balance

A strong, unique passphrase creates a different wallet. Back it up exactly and separately from the seed, and record its wallet fingerprint. A forgotten or mistyped passphrase cannot be recovered.

Wallet descriptor

For multisig, back up the descriptor. Seeds alone are not enough to reconstruct the wallet policy, cosigner order, paths, and quorum.

Backup options

OptionUse it forDo not confuse it with
Written seedCapturing words during setup.Long-term durability if it stays on paper.
Metal seed backupFire- and water-resistant long-term storage.A complete plan by itself; location and access still matter.
Encrypted MicroSD backupRestoring COLDCARD settings, Trick PINs, multisig registrations, and device state.Your seed words. It only restores on COLDCARD.
SeedXORSplitting seed storage across locations.Threshold multisig. SeedXOR is N-of-N; lose one part and you lose the seed.
Multisig descriptorReconstructing a multisig wallet.A spending secret. It is public key data, but you still need it.

Recovery drill

  1. Fund only a small test amount.

    Keep the first deposit tiny until recovery works.

  2. Restore the seed and passphrase.

    Use a spare or wiped device if possible. Restore the seed, apply the exact passphrase, and verify the expected passphrase wallet fingerprint.

  3. Compare receive addresses.

    The restored wallet should show the same first addresses as the original wallet export.

  4. Sign and broadcast a small spend.

    Do a complete PSBT round trip. You have not tested recovery until the restored wallet can spend.

Device rules do not protect a copied seed.

Trick PINs, spending policy, and HSM rules can restrict a COLDCARD device. If someone gets the seed and any passphrase, they can restore elsewhere and bypass device-side rules. Keep durable backups away from day-to-day signing setups.

Backups SeedXOR Multisig