Compare / COLDCARD Mk4 / Mk5 vs Trezor Safe 3
COLDCARD Mk4 / Mk5 vs Trezor Safe 3: firmware, security track record & price
A side-by-side look at how often each device gets updates, how many of those were security-related, and what each costs at the official store today. Numbers come from each maker's own release notes and store pages.
| COLDCARD Mk4 / Mk5 | Trezor Safe 3 | |
|---|---|---|
| Official price | $219 | $59 |
| Current firmware | 5.6.3 (Sep 30, 2026) | 2.13.0 (Oct 21, 2026) |
| Days since last update | 28 days | 7 days |
| Releases, last 12 months | 5 | 13 |
| Security-flagged releases, 12 mo | 2 | 7 |
| Incidents on record | 1 (worst: critical) | 1 (worst: low) |
| Where release notes are published | Public changelog/releases on GitHub | Public changelog/releases on GitHub |
| COLDCARD Mk4 / Mk5 at Coinkite | Trezor Safe 3 at Trezor |
"Security-flagged" means the vendor's notes mention a vulnerability, CVE, security fix or hardening. More flagged releases can mean more issues, or simply more transparent notes, so read the linked notes before drawing conclusions.
Security incidents for either device
- critical COLDCARD firmware bug produced weak seeds; funds stolen · Jul 30, 2026Coinkite's advisory says COLDCARD firmware released from 2021 to July 2026 had a bug that produced poor entropy during seed generation. Attackers regenerated the affected private keys offline and stole funds; the devices themselves were not remotely accessed.
- low Voltage glitch bypasses Trezor Safe 3 authenticity/firmware check · Mar 12, 2025Ledger Donjon showed that the Safe 3's microcontroller can be voltage-glitched to bypass its firmware-integrity and authenticity check. It needs full physical access and repackaging; Trezor says private keys and PIN cannot be extracted this way and that Safe 5 is not affected.