Do not use the alert itself as your trust anchor. Treat an unexpected Coldcard message and every link in it as unverified. Instead, open a bookmark or manually enter a known official COLDCARD or Coinkite address, locate the relevant notice or download there, and independently verify any firmware file before installing it. A familiar sender name, convincing logo, urgent wording, or a link that appears to mention Coldcard does not prove authenticity.
What you can and cannot establish from an alert
An alert can claim to be a security notice, firmware warning, account message, or support response. Without the exact message, sender details, and destination URL, nobody can declare that particular alert genuine or fraudulent. The safe decision is to leave the message’s path and rebuild the verification path from an address you already trust.
As an Amazon Associate I earn from qualifying purchases.
This distinction matters because an attacker can copy branding, spoof a display name, forward a real-looking notice, or place a legitimate-looking word in a different domain. The message may be useful as a prompt to investigate, but it is not evidence that its links are safe. The evidence comes from an independently reached official page and, for firmware, cryptographic checks performed on the downloaded file.
The COLDCARD About page gives the core rule: “Before downloading firmware, confirm that the browser address is on an official domain and verify the download using the firmware verification procedure.” That instruction applies even when the message looks professional or appears to come from a known contact.
#1 Best Overall
- EXPAND YOUR STORAGE. Insert your card to add massive storage up to 1.5TB[1] to your Android smartphones and tablets, digital cameras, and laptops.
- SPACE FOR MORE. With expansive capacities up to 1.5TB[1], capture and store hours of Full HD video[4], movies, music, games, photos, and podcasts.
- MOVE FILES FAST. Use your card with the SANDISK QuickFlow microSD UHS-I Card USB-A Reader[6] to achieve up to 195MB/s[2] read speeds [128GB-1.5TB models] and offload your content fast.
- LOAD APPS IN A SNAP. Rated A1[3], the SANDISK Ultra microSD card is optimized for faster app launch and overall app performance.
- EASY CONTENT MANAGEMENT. Easily back up, organize, and transfer your photos and videos with the SANDISK Memory Zone desktop or Android mobile app[5].
Use an independently reached official property
Do not click the call-to-action in the alert to “verify” the sender, unlock a device, or obtain an update. Open a fresh browser tab and use a bookmark you created previously, or type the address yourself. COLDCARD identifies these properties as official:
| Purpose | Official property | How to use it |
|---|---|---|
| COLDCARD website and documentation | coldcard.com | Start here for product documentation and links to current notices or downloads. Confirm the address shown by the browser before following a secondary link. |
| Company information | coinkite.com | Use for company-level information and support boundaries, not as proof that an unsolicited message is authentic. |
| Store | store.coinkite.com | Relevant only to purchases. A store page cannot validate a firmware file or a security alert. |
| Security notices and company updates | blog.coinkite.com | Look for a matching notice from the official route rather than using a link supplied by the alert. |
| Firmware source | github.com/Coldcard/firmware | Use the official firmware source reference when documentation directs you there. Do not assume that any repository with a similar name is genuine. |
Type the domain carefully. The browser’s address bar must show the official host, not merely a page title, logo, search result snippet, or sender-provided label. A lookalike address can place “coldcard” in a subdomain or in a longer domain controlled by somebody else. If the address does not exactly fit an official property, stop and return to a manually entered official address.
The official guidance also distinguishes the location of a notice from the message that prompted you to look. If the alert says there is a security announcement, reach the announcements from the COLDCARD site or the listed Coinkite blog. If no matching notice appears through that route, do not treat the alert’s link as an alternate source of truth.
Recommended Free Tools
A safe pre-click procedure
Use this sequence whenever an alert asks you to follow a link, download a file, or provide information.
- Pause. Do not click the message’s buttons, shortened links, attachments, or embedded images. Do not reply with account or wallet information.
- Record only non-sensitive clues. Note the subject, claimed purpose, visible sender address, and the text of the destination as displayed. Do not copy a link into a browser just to inspect it if doing so could trigger a redirect; you can type the official address separately.
- Open the official route independently. Use a known bookmark or manually enter coldcard.com. From there, follow the documentation or notices links supplied by the official site.
- Compare the claim, not just the wording. Look for a matching security notice, firmware release, or support guidance on the official property. A matching topic does not make the original message safe; it only tells you where to continue checking.
- Inspect every new address. Before downloading, confirm the browser address is on the expected official domain. Do not rely on a lock icon, a familiar page design, or a certificate warning that has been dismissed.
- Stop when a check fails. A lookalike domain, pressure to act immediately, a request for wallet secrets, or a file whose model and release family are unclear is sufficient reason not to proceed.
This process separates discovery from trust. The alert can tell you what to investigate, while the independently reached official documentation determines what action is safe.
When the alert offers a firmware update
Firmware requires a second layer of verification. The correct destination is not enough: you must establish that the file is intended for your exact COLDCARD model and that its contents match a signed manifest.
Rank #2
- EXPAND YOUR STORAGE. Insert your card to add massive storage up to 1.5TB[1] to your Android smartphones and tablets, digital cameras, and laptops.
- SPACE FOR MORE. With expansive capacities up to 1.5TB[1], capture and store hours of Full HD video[4], movies, music, games, photos, and podcasts.
- MOVE FILES FAST. Use your card with the SANDISK QuickFlow microSD UHS-I Card USB-A Reader[6] to achieve up to 195MB/s[2] read speeds [128GB-1.5TB models] and offload your content fast.
- LOAD APPS IN A SNAP. Rated A1[3], the SANDISK Ultra microSD card is optimized for faster app launch and overall app performance.
- EASY CONTENT MANAGEMENT. Easily back up, organize, and transfer your photos and videos with the SANDISK Memory Zone desktop or Android mobile app[5].
1. Open the official firmware downloads page
Reach the downloads page through coldcard.com or the current official documentation. Do not use a firmware URL copied from the alert. Firmware listings distinguish standard, Edge, and older-model releases, so identify your device before selecting a file.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThe firmware help page states: “Use only an official firmware file intended for your model.” The guidance was written by the Coinkite Team and reviewed July 17, 2026. Do not infer compatibility from a similar filename, a matching version number, or a file that happens to download successfully.
2. Match the exact model and release family
Read the model label on the device and select the corresponding listing. Check the release family as well as the version. A standard-model file is not interchangeable with an Edge or older-model file merely because the names look related.
- Confirm the hardware model shown in the official listing.
- Confirm that the release family matches that model.
- Check that the file name and any model designation agree with the listing.
- If the listing or documentation leaves compatibility uncertain, stop and seek clarification through the official route rather than guessing.
3. Download the complete file and the manifest
Use the official download listing to obtain the full firmware file and its signatures.txt manifest. Keep both files together and do not rename them until verification is complete. A successful download, a file size that looks plausible, or a microSD card containing the file is not evidence of authenticity.
4. Verify the OpenPGP signature on signatures.txt
The manifest is signed. Follow the current official firmware-verification procedure to check that the OpenPGP signature on signatures.txt is valid. This step establishes that the manifest itself was signed by the expected signing key according to the official instructions. If the signature is missing, invalid, or cannot be checked, do not use the manifest and do not install the firmware.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesDo not treat a text file that merely contains a hash as a signed manifest. The signature check must succeed before the values in the manifest can serve as the reference for the firmware file.
Rank #3
- Expand your storage in a flash: ideal for Android smartphones and tablets, and Windows laptops.
- Up to 140MB/s transfer speeds to move up to 1000 photos per minute
- Load apps faster with A1-rated performance
- View, access, and back up your phone’s files in one location with the SanDisk Memory Zone app
- Relax knowing your card is backed by a 10-year limited warranty by SanDisk
5. Calculate the firmware’s SHA-256 hash locally
Use the hash utility on your computer to calculate the SHA-256 digest of the exact firmware file you downloaded. Common systems provide a utility such as sha256sum or shasum -a 256; use the command appropriate to your operating system and the current official instructions.
Compare the locally calculated value character for character with the firmware hash recorded in the now-verified signatures.txt manifest. Both checks are required:
| Check | What it proves | What a failure means |
|---|---|---|
OpenPGP signature on signatures.txt |
The manifest is authentic under the official signing procedure. | Do not trust any hashes in the manifest. Obtain a fresh copy through the official route and repeat the documented verification. |
| Local SHA-256 hash of the firmware | The file on your computer matches the file identified by the signed manifest. | The download may be incomplete, altered, or the wrong file. Do not install it; download the exact model and release again. |
A hash comparison is not a replacement for the domain check or model check. An attacker could give you a validly formatted file with a name that resembles the real one; only the signed manifest and the official model listing provide the necessary context.
6. Install only after both checks pass
Once the model, release family, manifest signature, and local hash all agree, use the documented upgrade procedure. A microSD card is one official installation route and can be used as a transfer medium for the verified file. The card does not authenticate the alert, the computer, or the firmware by itself. Follow the current upgrade instructions for how the file must be placed on the card and how the device should be updated.
If any check fails, remove the unverified file from the transfer media, return to the official downloads page, and start again. Do not “try it anyway” to see whether the device accepts it.
How to recognize a stop condition
Stop before clicking or installing when one or more of these conditions appears:
Rank #4
- CAPTURE LARGER THAN LIFE. Unlock startling 5K[3] point-of-view and pristine high-res stills with video speed class ratings of U3 and V30[4].
- SPEED BARRIERS SHATTERED. Save precious moments with rapid read speeds up to 245MB/s[2] and write speeds up to 170MB/s[2] [256GB-1TB capacities[1]].
- MAXIMIZE WITH MASSIVE CAPACITY. Record longer and store more with up to 2TB[1] of storage.
- DURABILITY YOU CAN COUNT ON. SANDISK microSD cards are temperature proof, humidity proof, waterproof, shock proof, drop proof, magnet proof, X-ray proof and wear-out proof[7].
- EASY CONTENT MANAGEMENT. Easily back up, organize, and transfer your photos and videos with the SANDISK Memory Zone desktop or Android mobile app[10].
- The message creates urgency and says you will lose access unless you act through its link.
- The browser address is not exactly an official COLDCARD or Coinkite property, or it uses a lookalike domain.
- The alert asks you to install a file before you can read the notice or verify the download.
- The firmware listing does not clearly identify your exact model and release family.
signatures.txtis absent, its OpenPGP signature is invalid, or the signing key cannot be checked using the official procedure.- The local SHA-256 value does not match the value in the signed manifest.
- Someone claiming to be support asks for seed words, a passphrase, dice-roll sequences, private keys, or wallet backup files.
- The proposed process requires you to bypass a warning, disable security software, or send the downloaded file to another person for “approval.”
These are not inconveniences to work around. They are reasons to abandon the message’s workflow and re-enter the official route manually.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Keep wallet secrets out of the conversation
Coinkite says support will not ask for your seed words, passphrases, dice-roll sequences, private keys, or wallet backup files. No legitimate verification procedure requires you to disclose them to a person, a web form, or an alert link.
Do not paste a seed phrase into a support chat, type it into a website to “validate” a device, photograph a backup, or transmit a wallet file. A request for any of these items turns the interaction into a stop condition, even if the requester knows your device model or quotes genuine documentation.
You can describe a problem without revealing secrets: provide the model, the non-sensitive error text, and the official firmware version you verified. Keep recovery material offline and under your control.
What to do if you already clicked
If you opened a page but entered nothing
Close the tab, do not download or run files from it, and restart the verification from a manually entered official address. Review the browser’s downloads list and remove any file you did not intentionally obtain from the official route. Do not open an attachment merely to identify it.
If you downloaded firmware but did not install it
Do not copy it to the device or microSD card for installation. Delete the file and obtain a fresh copy from the official downloads page. Then verify the exact model and release family, the OpenPGP signature on signatures.txt, and the local SHA-256 hash.
Best Value
- CAPTURE LARGER THAN LIFE. Unlock startling 5K[3] point-of-view and pristine high-res stills with video speed class ratings of U3 and V30[4].
- SPEED BARRIERS SHATTERED. Save precious moments with rapid read speeds up to 245MB/s[2] and write speeds up to 170MB/s[2] [256GB-1TB capacities[1]].
- MAXIMIZE WITH MASSIVE CAPACITY. Record longer and store more with up to 2TB[1] of storage.
- DURABILITY YOU CAN COUNT ON. SANDISK microSD cards are temperature proof, humidity proof, waterproof, shock proof, drop proof, magnet proof, X-ray proof and wear-out proof[7].
- EASY CONTENT MANAGEMENT. Easily back up, organize, and transfer your photos and videos with the SANDISK Memory Zone desktop or Android mobile app[10].
If you entered wallet secrets
Treat the wallet as potentially compromised and stop using the suspicious channel. Do not provide additional information to anyone offering to “recover” the funds. Use the official documentation and trusted, independently obtained support contacts to determine an appropriate response; the alert itself is not a safe support channel.
If you installed an unverified file
Do not continue following instructions from the message. Preserve the relevant non-sensitive details, disconnect from the suspicious workflow, and consult the current official COLDCARD security and upgrade documentation through a manually entered address. The reviewed guidance explains how to verify official files, but it does not authenticate an unnamed alert after installation.
Recheck changing information before every update
Firmware listings, release families, security notices, signing details, and upgrade instructions can change. The security-status page’s change log was updated October 1, 2026, and current listings should be checked again at the time you act. Do not rely on an old screenshot, cached page, or a previous version’s filename.
For each update, repeat the independent navigation and the complete verification sequence. A file that was correct for one model or release family is not automatically correct for another, and a previously trusted message does not make a new link safe.
A printable verification checklist
- I paused and did not use the alert’s links as my starting point.
- I opened a known official address by bookmark or manual entry.
- I confirmed the browser address before downloading anything.
- I found the notice or firmware listing through the official site.
- I identified my exact COLDCARD model and matching release family.
- I downloaded the complete firmware file and
signatures.txtfrom the official route. - I verified the OpenPGP signature on
signatures.txtusing the official procedure. - I calculated the firmware’s SHA-256 hash locally.
- I matched that hash to the value in the signed manifest.
- I used the documented upgrade process only after every check passed.
- I kept seed words, passphrases, dice-roll sequences, private keys, and backup files private.
If you cannot check every applicable item, do not click through or install. Return to the official COLDCARD documentation and begin again.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
