Coldcard MK4 Firmware Update: A Safe 5-Step Process

Coldcard MK4 Firmware Update: A Safe, Step-by-Step Guide

When was the last time you checked your Coldcard firmware?

Skipping a Coldcard MK4 firmware update isn't the end of the world, but falling months behind a device that stores your bitcoin isn't a smart idea. Coinkite releases updates regularly: bug fixes, security improvements, and sometimes new features.

In this article: how to safely download the Coldcard MK4 firmware, verify the hash, and install it via SD card.

Coldcard MK4 Firmware Update: Why and How Often?

Performing a Coldcard MK4 firmware update isn't a big deal, but it is something you need to do regularly. Coinkite releases updates several times a year on average.

Reasons for a Coldcard MK4 firmware update:

• Security improvements (always priority)
• Bug fixes for known issues
• New features and improved usability
• Compatibility with new wallet standards such as PSBT v2

How often? Check coldcard.com every 1–3 months to see if a new version is available. After a security announcement: update immediately.

What do you need for a Coldcard MK4 firmware update?

• Coldcard MK4
• MicroSD card (FAT32 formatted, maximum 32 GB)
• Computer with internet (once, for downloading)
• SHA-256 verification tool (built into Windows, macOS, and Linux)
• Optional: GPG software for PGP verification (recommended for maximum security)

The SD card is the only link between your computer and the Coldcard. This ensures that the Coldcard remains air-gapped during the update.

Step 1: Download latest firmware

Go to the official Coinkite download page on your computer: coldcard.com/docs/upgrade

Download the latest firmware file. That is a .dfu-file. Also note the SHA-256 hash listed on the page. You will need it later.

Download only from coldcard.com. Never from other sources, never from torrents or Telegram links. Not because that’s excessive, but because you don’t want to have to double-check this if something goes wrong.

Step 2: Verify the hash

Before putting the file on the SD card, verify the SHA-256 hash of the downloaded file.

On Windows (PowerShell):

Get-FileHash coldcard-firmware.dfu -Algorithm SHA256

On macOS/Linux (Terminal):

shasum -a 256 coldcard-firmware.dfu

Compare the output with the hash on coldcard.com. Exactly. Character by character.

Does the hash match? Proceed. Does it not match? Delete the file and download again. Never proceed with an unverified firmware file.

This is not an optional step. This is the only way to know that you have the real Coinkite file.

Step 3: Copy the firmware to the SD card

Copy it .dfu-file to the root of the microSD card. Not in a folder. Directly on the card.

Safely remove the SD card from the computer.

Step 4: Installing the Firmware on the Coldcard MK4

1. Turn off the Coldcard MK4 (or unplug the power cord if it doesn't have a battery)
2. Insert the micro-SD card into the SD card slot on the Coldcard
3. Start the Coldcard
4. Go through the menu to Advanced/Tools Okay Upgrade Firmware
5. Choose From MicroSD
6. The Coldcard displays the file name and the SHA-256 hash. Check to see if the hash matches what you verified earlier.
7. Confirm the update

The Coldcard restarts automatically after installation.

Step 5: Check the installed version

After the restart you go to Advanced/Tools Okay Upgrade Firmware and you look at the active version. That must match the version you downloaded.

Done. Your Coldcard MK4 is now running the latest firmware.

Which version is the lower limit, and why updating is not enough

Ever since the entropy problem of July 2026, there is a hard lower limit per model. If you are below it, updating is not optional:

• Mk4 and Mk5: version 5.6.0 or newer (Edge: 6.6.0X)
• Coldcard Q: version 1.5.0Q or newer (Edge: 6.6.0QX)
• Mk3: version 4.2.0

And then the point that most people miss: Updating does not repair your existing seed. The error was in the creation of the seed, not in the device itself. Your 24 words remain exactly what they were after the update, with the same weakness. If your seed was created on older firmware, the order is: update first, then create a new seed, check the backup, test with a small amount, and only then move your balance.

You are not affected if you entered your seed yourself, if you have rolled at least 50 of your own dice, or if you use a strong unique passphrase. If you are not sure, assume that it does affect you.

Download firmware only from coldcard.com, and go there by typing the address directly into your browser. Never click on a firmware link in an email, not even one that appears to be from us. There are currently many scams circulating related to this topic.

Is a Coldcard MK4 firmware update risky?

Short version: no, provided you verify the hash.

Longer version: an incorrectly downloaded or manipulated firmware file could theoretically cause damage. But if you perform step 2 correctly (hash verification), the risk is zero. Coinkite has published the hash. You compare. If they match, it is the real file.

Your PIN and seed phrase do not change as a result of a firmware update. Just to be safe, always make a backup of your seed phrase before you begin, if you haven't already.

Verifying the Coldcard MK4 firmware update via PGP (advanced)

SHA-256 verification is the minimum check. For maximum security, you also perform PGP signature verification. Coinkite signs every firmware file with their PGP key.

This requires GPG software on your computer. Steps:

1. Download the PGP signature (.sig file) along with the .dfu file from coldcard.com
2. Import Coinkite's public key (available at coldcard.com)
3. Verify: gpg --verify coldcard-firmware.dfu.sig coldcard-firmware.dfu
4. You will see a confirmation from Coinkite if everything is correct

This adds an extra layer of verification on top of the SHA-256 hash check. For a Coldcard MK4 firmware update where you want maximum security: perform both verifications.

Coldcard MK4 Firmware Update: Differences Between the MK4 and Other Coldcard Models

The Coldcard MK4 is the predecessor to the Coldcard Q. Both devices use the same firmware update process via SD card. However, there are differences:

• Firmware files: MK4 firmware does not work on the Coldcard Q, and vice versa. Always download the file for your specific model.
• SD card format: The MK4 uses a micro-SD card. Always check the specifications for your model at coldcard.com.
• Menu structure: the menu names in this article are for the MK4. The Q has a different interface, but the process is similar.

If you're considering upgrading to the Coldcard Q: that means buying a new device, not a Coldcard MK4 firmware update. The Q has a larger color screen, a physical keyboard, and NFC, which the MK4 doesn't have.

Coldcard MK4 firmware update: Back up before the update

Your PIN and seed phrase will not change as a result of a Coldcard MK4 firmware update. However, if something goes wrong during the update, the device may end up in an intermediate state.

Precautionary steps to take before every Coldcard MK4 firmware update:

1. Check that your seed phrase is written down correctly and completely
2. Create an XFP backup via the menu
3. Use a stable power source (not a nearly empty battery)
4. Use a reliable SD card (no cheap unknown brands)

In practice, Coldcard MK4 firmware updates almost always go smoothly. But it takes just 5 minutes to prepare, and it can save you a lot of stress.

Coldcard MK4 firmware update: How can you stay informed?

The Coldcard MK4 does not have Wi-Fi or an internet connection. Therefore, there are no automatic updates. You are responsible for checking for and installing updates.

A practical way to stay up to date on new Coldcard MK4 firmware updates:

• Subscribe to the Coinkite newsletter for announcements
• Set a calendar reminder to check coldcard.com every month
• Following a security announcement: Please prioritize the Coldcard MK4 firmware update immediately

Some Bitcoin users perform the Coldcard MK4 firmware update alongside other maintenance tasks: checking their wallet backup, verifying their seed phrase, and checking their cold storage. Combine these tasks for efficiency.

Troubleshooting: most common errors

SD card is not recognized Check if the card is formatted as FAT32. exFAT and NTFS are not supported. Use a card with a maximum capacity of 32 GB. Try a different card if the problem persists. Hash is incorrect Delete the file and download it again from coldcard.com. Check your internet connection and try a different browser if the problem persists. Firmware update failed halfway through Connect the Coldcard to a stable power source. A battery leak or power outage during an update can cause problems. If a problem occurs, restart the device and repeat the update. Menu options not visible Check if you are not in a restricted menu due to a PIN setting. Some advanced menus are only accessible after entering an additional PIN.

Are you considering an upgrade?

The Coldcard MK4 is an excellent device. But its current successor takes it a step further: the Coldcard Q It has a large color screen, a physical keyboard, NFC, and is available immediately through BitcoinStuffStore.

Since you are refreshing your setup anyway, it is a good time to compare.

A good seed backup is always part of a hardware wallet. The Seedfan Steel Kit is stainless, fire- and water-resistant, and immediately available.

Frequently Asked Questions About the Coldcard MK4 Firmware Update

How do I update the Coldcard MK4 firmware? Download the firmware file from coldcard.com, verify the SHA-256 hash, copy it to the root directory of a FAT32-formatted micro-SD card, and install it on the Coldcard itself via Advanced/Tools > Upgrade Firmware > From MicroSD. Where can I download the latest Coldcard firmware? Exclusively via the official Coinkite website: coldcard.com/docs/upgrade. Never from third parties. How do I verify the hash of a Coldcard firmware file? On Windows via PowerShell: Get-FileHash file.dfu -Algorithm SHA256. On macOS or Linux: shasum -a 256 bestand.dfu. Compare the output with the hash on coldcard.com. Is a firmware update risky for my Coldcard? Not unless you verify the hash. Your PIN and seed phrase do not change. Just to be safe, create a fresh seed backup before you begin. What do I need for a Coldcard firmware update? A Coldcard MK4, a FAT32-formatted micro-SD card (up to 32 GB), a computer for downloading and verifying the hash, and access to coldcard.com.

Your security is as strong as the weakest link

Firmware up to date. Seed securely stored. Done.

I test hardware wallets before they hit the shelf. That is the difference between advice from someone who knows and advice from someone who Googled.

P.S. The Coldcard Q is the current successor to the MK4 and available for immediate delivery. If you are upgrading anyway, consider it.

Internal links (verified instock)

• Coldcard Q (upgrade option, successor to the MK4)
• Seedfan Steel Kit seed backup on steel

Coldcard MK4 firmware update: additional security measures after the update

After a Coldcard MK4 firmware update, it's a good time to go over your entire setup.

A Coldcard MK4 firmware update is more than just a technical procedure. It’s an opportunity to evaluate your security practices. Coinkite urges users to install regular updates not only for new features, but also for security patches.

Check PIN

Check after every update whether your PIN still works correctly. The PIN does not change due to a firmware update, but it is good to confirm this before putting the wallet back in your storage location.

Seed phrase checklist

Is your seed phrase still completely legible? Are you storing it in a suitable location? Paper decays. A Seedfan Steel Kit is fire- and water-resistant and remains readable where paper fails.

Read changelog

Read the changelog on the Coinkite page after every update. Coinkite documents what has changed and why. This gives you insight into what the firmware update has fixed and whether there are new features you want to activate.

Coldcard MK4 Firmware Update: Additional Questions

Coldcard MK4 Firmware Update: Understanding Firmware Version Numbering

Coinkite uses a version number format like 6.x.x. The first digit is the major version, the second is the minor release, the third is the patch. Security updates often appear as patch versions (6.x.1 to 6.x.2). Major feature releases are minor updates.

Every Coldcard MK4 firmware update comes with release notes on coldcard.com. Be sure to read them before installing. That way, you'll know what's changed and whether any specific actions are required before or after the update.

Coldcard MK4 firmware update: Ready for the Next Time

Now that you know how a Coldcard MK4 firmware update works, the next time it'll only take about 10 minutes. Download, verify the hash, copy to an SD card, install, and check. Done.

Make it part of your routine: check coldcard.com once a quarter. If there’s an update, install it. If the version is already up to date, do nothing. The Coldcard MK4 firmware update is perhaps the simplest security measure you can take for your bitcoin, but also one of the most worthwhile. Make sure you don’t skip it.

The Coldcard MK4 firmware update is a simple but essential security measure. By performing it regularly, you ensure that your device always has the latest bug fixes and security enhancements. That’s good bitcoin management: simple, consistent, and done by you.

---

See also

Coldcard MK4, Coldcard Q, Seedfan Steel Kit.

View all hardware wallets.