Hardware wallets

Coldcard Q

Coldcard with a full QWERTY keyboard, a larger screen, a QR scanner and two microSD slots for air-gapped signing.

Official Coldcard Q websitearound $319

What is Coldcard Q?

Coldcard Q is a Bitcoin-only hardware wallet made by Coinkite. Compared with the Mk4, the documentation says the Q adds a full QWERTY keyboard, a larger color screen (320 x 240 pixels), a QR scanner, a second microSD slot and optional battery power. The maker’s page says it uses two Secure Elements from different vendors, naming Microchip’s ATECC608 and Maxim’s DS28C36B, and that the Coldcard never needs to touch a computer. The maker’s page lists it at $319. This page describes the Q; the Coldcard Mk5 is a separate product.

Key facts

Type
Hardware
Made by
Coinkite, Canada
Works with
Windows, macOS, Linux, Android, iOS
Keys
You hold the keys
Bitcoin-only
Yes
Source code
Partly openSource code is public under MIT with the Commons Clause, which does not grant the right to sell the software.
Lightning
No
Multisig
Yes
Air-gapped
Yes, signs without a cable connection
Experience
Advanced
Price
around $319

Details last checked on the maker's website: . How we compare

Good for

  • Air-gapped signing with QR codes instead of a memory card
  • Long passphrases, thanks to the keyboard

Watch out

  • Coldcard's security status page (checked 2026-10-19) says a firmware bug weakened seed generation in versions from 2021 to July 2026. Seeds generated on affected firmware, including Mk4, Mk5 and Q, should be migrated to a new seed, because updating the firmware does not repair an existing seed. Fixed releases start at 5.6.0 (Mk4, Mk5) and 1.5.0Q (Q), and the page recommends 5.6.3 and 1.5.3Q. See coldcard.com/security/status
  • Large and the most expensive device in this list
  • Runs on three AAA batteries or USB power

Coldcard Q features

Keyboard and screen. The Q has a full QWERTY keyboard with 50 keys, where the Mk4 has 12, and a 320 x 240 pixel color LCD. The maker says the keyboard is ideal for long BIP-39 passphrases. QR scanner and BBQr. The documentation describes a dedicated scanner module with LED illumination rather than a phone-style camera. According to the multisig guide, the Q can export an XPUB by QR code using the BBQr specification, and import or export multisig setups through QR codes. The receiving device must implement BBQr. The compatibility list names Sparrow, Nunchuk and BlueWallet as supporting the Q’s QR scanner and BBQr. Storage, power and connections. The Q has two push-pull microSD slots, with two more places for spare cards behind the battery door. It runs on three AAA cells or USB-C power, and unlike the Mk4 it does not start when power is applied; you press the power key. It also has NFC and a USB-C port, and the documentation says USB and NFC data can be disabled permanently by cutting a trace on the circuit board. PIN options and seed generation. The PIN has two parts of 2 to 6 digits each. The maker’s page describes an optional duress PIN that opens a separate wallet, and a Brick Me PIN that destroys the dual secure element. A new seed combines device entropy with one required input: at least 65 key presses with unpredictable timing, 50 physical dice rolls or 128 coin flips. Co-signing, Seed Vault and notes. The maker’s page lists Coldcard Co-Signing, which adds a second seed, the Spending Policy Key, to 2-of-N multisig wallets that enforce spending policies. It also lists a Seed Vault that stores temporary secrets in encrypted settings, and Secure Notes and Passwords for password-manager style storage.

Security and custody

Coldcard publishes its firmware on GitHub. The README says the Q and the Mk series share the same code base and describes a Docker-based process for reproducible builds, with a separate Makefile for the Q. The licence is the MIT licence with the Commons Clause, which says the grant of rights does not include the right to sell the software, where selling includes providing a paid product or service whose value comes substantially from it. Coldcard’s security status page, last updated 2026-10-01, says a firmware bug weakened seed generation, and the README says versions from 2021 to July 2026 had a bug that produced poor entropy. According to the status page, attackers regenerated affected private keys offline; the devices themselves were not taken over remotely. Seeds generated on affected firmware, including on the Q, Mk4 and Mk5, should be migrated to a new seed, because updating the firmware does not repair an existing seed and a BIP-39 passphrase does not either. The first fixed release for the Q is 1.5.0Q, and the page recommends 1.5.3Q. The page makes an exception for seeds where at least 50 fair, private dice rolls were added with the Add Dice Rolls workflow; the migration guide at coldcard.com/security/migrate sets the exact conditions.

Coldcard Q alternatives

Compare all hardware wallets side by side

Related lists: multisig wallets bitcoin-only wallets all wallets A–Z

Coldcard Q FAQ

Does the Coldcard Q have a camera?

Not according to its documentation. It reads QR codes with a dedicated scanner module with LED illumination, which the documentation compares to a grocery store scanner rather than a phone camera.

What power does the Coldcard Q use?

Three AAA cells or USB-C power, according to the maker. It does not start when power is applied over USB-C: you press and hold the power key for a full second.

Which wallet software works with the Coldcard Q's QR codes?

The Coldcard documentation lists Sparrow, Nunchuk and BlueWallet as supporting the Q's QR scanner and BBQr data transfer. BlueWallet added BBQr support in version 7.2.6.

Is there a security notice for Coldcard seed generation?

Yes. Coldcard's security status page says a firmware bug weakened seed generation in versions from 2021 to July 2026. A seed generated on affected firmware, including on the Q, Mk4 and Mk5, should be migrated to a new seed, because updating the firmware does not repair it. The first fixed release for the Q is 1.5.0Q, and the page recommends 1.5.3Q. The details are at coldcard.com/security/status.

Guides

Sources

The text above was checked on against these pages: