Before you begin

Replace the affected seed

Create a replacement seed from physical randomness, build and test the new wallet, then spend the old wallet into it.

Updating the firmware protects later operations. It does not change or repair a seed that was already generated.

Identify the seed's origin

Select the Coldcard that originally generated the seed, not the device holding it today.

Check the advisory exceptions

Coinkite says the RNG issue does not put a seed at risk if you mixed in at least 50 fair, independent and private dice rolls when creating it.
A strong, unique BIP-39 passphrase adds protection, but it does not repair weak seed entropy. The vendor still recommends migration.

Use the Coinkite advisory to confirm that your exact seed-generation path is covered.

Can affected keys satisfy the wallet?

For single signature, use 1-of-1 and one affected signer.

Required signatures (m)

Total signers (n)

Affected signers

Before changing anything

Stop issuing old receive addresses. Record pending transactions and services that may still pay an old address.
For multisig, save the complete receive and change descriptors (wallet policies containing public keys and derivation rules), threshold, script type, signer fingerprints, derivation paths and cosigner extended public keys (xpubs).
Download and print the worksheets and lookup book before the private ceremony. Use pen and paper for bits, words and recovery notes.
Keep enough old signing keys available until the migration confirms and late payments have been handled.

Using BIP-85? First create a new safe parent seed. Never derive the replacement child from the affected parent.

Block technical analysisRoot cause and affected firmware paths.Wizardsardine assessmentIndependent risk and migration guidance.Coinkite advisoryFixed releases and vendor instructions.

Verify this guide

Confirm the nsite publisher's npub through a separate trusted channel.
Download SHA256SUMS. Compare its index.html hash with the separately signed Nostr release announcement. A hash delivered only with the same package is not independent proof.
View source. Confirm there are no external scripts, fonts, analytics, storage calls or background network requests. The only image is the local favicon.
Cross-check the public word list with the official BIP-39 English list.

Calculate the hash of the file you saved. Open PowerShell, Command Prompt or Terminal in the folder containing index.html. Run the command for your operating system, then compare the 64-character result with the separately signed release hash.

Windows · PowerShell or Command Promptcertutil -hashfile .\index.html SHA256

macOS · Terminalshasum -a 256 ./index.html

Linux · Terminalsha256sum ./index.html

Step 2

Update the Coldcard

Update only if you plan to keep using this Coldcard during the rotation. You can create the replacement seed and calculate its checksum with another device first.

Choose the device

Select the model that will receive the update.

Before updating: confirm that the old seed, passphrase and multisig recovery data are backed up outside the device. Do not erase the old seed until the replacement wallet has been tested.

Verify the downloaded file

Compare the local SHA-256 with Coinkite's signed manifest, then verify the PGP signature and signing-key fingerprint.

Signed firmware manifest Official verification and update guide

Calculate the hash of the downloaded firmware. Open PowerShell, Command Prompt or Terminal in the folder containing the .dfu file. Replace FILE.dfu with the exact filename shown above, run the matching command, and compare the result with the signed manifest.

Windows · PowerShell or Command Promptcertutil -hashfile "FILE.dfu" SHA256

macOS · Terminalshasum -a 256 "FILE.dfu"

Linux · Terminalsha256sum "FILE.dfu"

Use Coinkite signing key fingerprint 4589779ADFC14F3327534EA8A3A31BAD5A2A5B10. Verify it against Coinkite's official upgrade guide and Doc Hex's public Keybase profile.

Step 3

Create the replacement seed

Generate the entropy on paper. Use one of the methods below only to calculate the final BIP-39 checksum word.

Why this guide starts with binary: not everyone has access to an unbiased die, and coin or colour-pair results map directly to binary bits. Dice remain a valid optional Coldcard method below.

Coin flips

Recommended · coin, pen and printed paper material

Download: the 12-word worksheet or 24-word worksheet, plus the BIP-39 lookup book.

Set Heads = 1 and Tails = 0 before starting.
Write every result in the next bit box on the paper worksheet.
For each complete 11-bit row, find the identical row in the printed lookup and copy its word to paper.
Keep the final 7 bits for 12 words, or final 3 bits for 24 words, for the checksum step.

Example: H T H H T T H T T H T gives 10110010010. That is value 1426; add one for the printed list and use line 1427: rather.

Playing cards

Alternative · complete 52-card deck, pen and printed paper material

Download: the 12-word worksheet or 24-word worksheet, plus the BIP-39 lookup book.

Remove jokers. Shuffle thoroughly and cut the deck.
Deal two cards at a time: red-black = 1, black-red = 0. Discard same-colour pairs.
Write only accepted bits. When the deck ends, reshuffle and continue.
Stop after 128 accepted bits for 12 words or 256 for 24 words.

Example: red-black, black-red, red-red gives 1, 0, discard. The accepted row 10101100101 is value 1381; use line 1382: protect.

Download the paper material

Choose the word count once. The same worksheet works for coin flips or playing cards. Open each PDF locally and print it before the ceremony.

Download 12-word worksheet Download 24-word worksheet Download BIP-39 lookup book

Calculate the final word

Every method below receives enough information to reconstruct the seed. Use an isolated tool whose source and release you have verified. When practical, check the result with a second implementation before funding the wallet.

SeedSigner

Direct final-word calculation from the paper words and final physical bits.

What you need

A verified SeedSigner, preferably on Raspberry Pi Zero 1.3. Download the 12-word worksheet or 24-word worksheet, plus the BIP-39 lookup book.

What it learns

The complete seed while it is loaded. A stateless Pi Zero 1.3 has no Wi-Fi or Bluetooth and forgets the seed when power is removed.

Steps

Open Tools > Calc 12th/24th word.
Choose 12 words or 24 words and enter words 1-11 or 1-23 from paper.
Choose Coin flip entropy.
Enter the final 7 or 3 flips using Heads = 1 and Tails = 0.
Write the calculated final word on paper, choose Discard, and power off.

SeedSigner features and verified releases

Krux

Enter the paper bits directly; Krux fills the checksum positions in the final word.

What you need

A verified dedicated Krux device. Download the 12-word worksheet or 24-word worksheet. Krux accepts the recorded bits directly, so the lookup book is optional.

What it learns

The complete seed while loaded. Do not use the Krux Android test application for important seeds.

Steps

Open Load Mnemonic > Manual Input > Tinyseed (Bits).
For each ordinary word, toggle the values matching its 11 paper bits.
For a 12-word seed, enter the final 7 bits at values 16, 32, 64, 128, 256, 512, 1024. Krux calculates values 1, 2, 4, 8.
For a 24-word seed, enter the final 3 bits at values 256, 512, 1024. Krux calculates values 1-128.
Confirm the final word, write it on paper, then shut down without saving the mnemonic.

Krux Tinyseed (Bits) instructions

Specter DIY

Enter a placeholder final word, then use Specter DIY's checksum repair function.

What you need

Verified Specter DIY firmware in amnesic mode. Download the 12-word worksheet or 24-word worksheet, plus the BIP-39 lookup book.

What it learns

The complete seed. Do not save it. Avoid USB and SD-card communication during the ceremony, then power off.

Steps

Choose Enter recovery phrase and enter words 1-11 or 1-23.
Make a placeholder final row on paper: append 0000 to the final 7 bits for 12 words, or 00000000 to the final 3 bits for 24 words.
Use the printed lookup to turn that 11-bit row into a temporary final word and enter it.
If fix appears, select it. Specter keeps the physical entropy bits and replaces the placeholder checksum bits. If fix does not appear, the placeholder word already has the correct checksum and is the final word.
Write the corrected final word on paper and power off without saving the key.

12-word public example: 1011001 + 0000 = 10110010000 → line 1425 rare. With eleven abandon words, fix changes the final word to record.

24-word public example: 101 + 00000000 = 10100000000 → line 1281 parade. With twenty-three abandon words, fix changes the final word to ready.

Specter DIY security and firmware guidance

Tails

A practical fallback when no dedicated checksum device is available.

What you need

A verified Tails USB and a second USB containing this package. Download the 12-word worksheet or 24-word worksheet, plus the BIP-39 lookup book.

Download the checksum-only Python script

What it learns

The computer sees the complete seed in RAM. Tails removes the non-persistent session at shutdown, but cannot protect against compromised firmware or hardware.

Steps

Verify Tails, then boot it directly from USB. Do not run it in a virtual machine.
Do not create or unlock Persistent Storage. Leave networking disconnected and do not mount internal disks.
Open the package USB and verify the files with sha256sum -c SHA256SUMS.
Run python3 bip39-final-word.py. Enter words 1-11 or 1-23 as their printed word numbers, then enter the final 7 or 3 bits.
Write the displayed final word on paper and shut Tails down completely.

Download and verify Tails

Trezor

Verification only. Trezor validates a complete BIP-39 backup during recovery; it does not calculate the missing final word or list candidates.

What you need

A blank or deliberately wiped Trezor that supports 12- or 24-word BIP-39 recovery, and the completed 12-word worksheet or 24-word worksheet. Calculate the final word with another tab first.

What it learns

The complete seed. Recovery loads and stores it on the Trezor. On an initialized device, Check backup compares only with the seed already stored on that device.

Steps

Use SeedSigner, Krux, Specter DIY, Tails or Coldcard to calculate the final word.
On a blank or intentionally wiped Trezor, start wallet recovery and choose a 12-word or 24-word BIP-39 backup.
Enter the complete phrase on the device. An invalid BIP-39 checksum is rejected; a valid phrase proceeds to recovery.
After recovery, compare a receive address or wallet export with the intended wallet before funding it.
Do not wipe an existing Trezor merely to perform this check unless its current wallet is fully recoverable.

Trezor BIP-39 backup and recovery support

Coldcard

Use this only if you deliberately choose an updated Coldcard to finish the checksum after creating all entropy on paper.

What you need

An updated Coldcard. Download the 12-word worksheet or 24-word worksheet, plus the BIP-39 lookup book; its final-bit tables identify the correct candidate range.

What it learns

Words 1-11 or 1-23 leave only 128 or 8 possible seeds. The Coldcard can try all remaining possibilities.

Steps

Blank device: open Import Existing > 12 Words or 24 Words. On Mk4, Mk5 or Q with a seed already loaded, use Advanced/Tools > Temporary Seed > Import Words. Mk2 and Mk3 do not provide the current Temporary Seed workflow; use a blank device or another checksum method.
Enter words 1-11 or 1-23. The device shows checksum-valid final-word candidates.
For 12 words, convert the final 7 bits to value v; use candidate numbers v × 16 + 1 through v × 16 + 16.
For 24 words, use candidate numbers v × 256 + 1 through v × 256 + 256.
Choose the only displayed candidate inside that range and write it on paper.

12-word public example: final bits 1011001 are value 89, so inspect candidates 1425-1440. With eleven abandon words, choose record, line 1439.

24-word public example: final bits 101 are value 5, so inspect candidates 1281-1536. With twenty-three abandon words, choose ready, line 1431.

Official Coldcard seed-import instructions

How to verify the bit-to-word mapping

Each 11-bit row is an integer from 0 to 2047. It maps directly to that zero-based position in the official 2,048-word BIP-39 list. The printed word number is the value plus one.

00000000000 → line 1 abandon; 00000000011 → line 4 about; 11111111111 → line 2048 zoo.

There is no modulo reduction and no discarded word index. Compare the included list with the official BIP-39 English list.

Why the playing-card pairs are unbiased

In a thoroughly shuffled complete deck, every red-black pair has a matching black-red ordering with the same probability. Same-colour pairs are discarded, so the accepted result is equally likely to be 0 or 1.

Shuffling quality still matters. Reshuffle fully each time the deck runs out.

Optional: Coldcard Dice Roll Only

This is a different method. It requires an updated Coldcard and a fair six-sided die. The Coldcard hashes the complete roll sequence and creates the seed; it is not acting only as a checksum calculator.

Use 50 or more rolls for 12 words and 99 or more rolls for 24 words. More fair, private rolls are better. For example, 72 rolls are enough for 12 words, and 128 are enough for 24, because both exceed the minimum. You still need to verify the implementation.

Coldcard Dice Roll Only verification

Step 4

Build and test the new wallet

Use the new seed directly, or derive a BIP-85 child from a new safe parent. Then create a new wallet policy and verify it before moving the balance.

Same device for single-sig and multisig? Use the new seed as the parent, then derive a BIP-85 child for one of the two wallets. Record which wallet uses the parent, the child word count and the BIP-85 index. Never count the master and its child as separate cosigners in the same multisig.

Import the complete 12- or 24-word mnemonic into the replacement signer.
Record its master fingerprint, the signer's short wallet identifier, on paper and verify the backup on the device.
For single signature, create a new wallet and verify a receive address on the signer.
For multisig, create a new m-of-n descriptor. Do not reuse the affected account xpub.

What is secret, and what must be backed up?

Class	Keep	Why
Secret	Each seed phrase, any BIP-39 passphrase, BIP-85 parent seed, child seed and analogue worksheet.	Any complete seed plus passphrase can spend that signer's funds. Keep each cosigner under separate custody, in a separate place, on a separate device.
Public but privacy-sensitive	Receive and change descriptors, threshold, script type, all cosigner xpubs, fingerprints and derivation paths.	These do not spend alone, but they reveal wallet addresses and are required to reconstruct a multisig wallet.
Operational record	Wallet label, creation date, coordinator, account numbers, firmware versions and test transaction.	These prevent recovery mistakes and help confirm that the restored wallet is the intended one.

A multisig backup is incomplete if it contains only seed phrases. Store the descriptor with enough recovery sets that any valid m signers can rebuild the wallet, without placing m secret seeds together.

Test before the main transfer

Verify the new receive address on at least two signer displays.
Send a small amount to the new wallet and wait for confirmation.
Spend it using the intended signing threshold. Verify destination, fee and change on the signers.
Confirm the same descriptor and fingerprints can be restored from the backups.

Step 5

Move the funds

You cannot replace one signer inside an existing multisig wallet. Spend every old output into addresses from the new wallet.

Stop using old receive addresses and update any withdrawal whitelists or recurring payments.
Create a partially signed Bitcoin transaction (PSBT) that spends the old wallet's unspent transaction outputs (UTXOs) to independently verified addresses from the new wallet.
When the threshold allows it, sign with unaffected keys. Verify every output, fee and change output on the signer displays.
Avoid unintended change back to the old descriptor. If you migrate in batches, track every old change output until it is moved.
Broadcast, wait for confirmation, then rescan both old receive and change descriptors.

Keep watching the old wallet

Keep a watch-only copy of the old descriptor.
Choose and record a monitoring end date based on the longest payment cycle that still uses an old address. Keep enough old keys available until that date.
Move any late payment into the new wallet.
Retire old seed material only after the old wallet is empty and no issued address is expected to receive funds.

If affected keys meet the spending threshold, time matters. Prepare and verify the replacement, then move the funds without unnecessary delay.