Coldcard Mk4

The COLDCARD Mk4 is Coinkite's fourth-generation Bitcoin-only hardware wallet — a calculator-style signing device engineered for hardened cold storage and the privacy-conscious Bitcoin maximalist. Built in Toronto, Canada, the Mk4 has long been the reference device for PSBT power users, multisig setups and coin-control workflows.

True air-gap by default. Every radio and data path on the Mk4 — USB-C, microSD card slot and NFC tap — is OFF by default. You sign a PSBT on a watching-only wallet, transfer the unsigned file via microSD card (known as SneakerNET) or NFC, then sign it offline on the Mk4 and broadcast via NFC PushTx or microSD round-trip. The USB-C connector can power the device from a generic wall adapter or power bank so it never has to touch a computer.

Dual-secure-element architecture. Unlike wallets that trust the main microcontroller with the master secret, the Mk4 stores the BIP39 seed across two secure elements from different vendors — the Microchip ATECC608 and the Maxim DS28C36B — alongside the main MCU. For your funds to be compromised, a backdoor would need to exist across all three chips from three different vendors, an extraordinarily high bar.

Anti-coercion firmware. Coinkite's Trick PIN system gives you a Duress PIN that unlocks a decoy wallet, Brick-Me and Countdown-to-Brick PINs that destroy the device, a Login Countdown that enforces a delay, and full BIP39 passphrase support. The PIN is split into two halves with anti-phishing words shown on screen between them — unique per PIN prefix and per device — to defeat cloned or trojan-horse hardware.

Note: The Mk4 has been succeeded by the Mk5. The Mk5 keeps the same architecture (dual secure elements, NFC, microSD air-gap, sliding cover) and adds an improved screen and keyboard. This profile covers the Mk4 as still available and widely deployed; the Mk5 is functionally equivalent for new buyers.

Multiple Connection Modes — All OFF by Default

• USB-C for data and power (industry standard).
• MicroSD card (SneakerNET) for maximum-security air-gapped PSBT signing.
• NFC Tap for short-range wireless transfer to a phone.
• Virtual Disk mode — the Mk4 emulates a USB drive so you can drag-and-drop PSBT files like a thumb drive.
• NFC PushTx — single-tap broadcast of freshly-signed transactions from the Mk4 to your phone, no cable needed.
• Every radio and data port is disabled unless you explicitly enable it.

Air-Gap End-to-End

• The Mk4 never needs to touch a computer at all. It can run from a USB power pack or AC adapter for the whole life of the product — from initial PIN setup to seed generation to daily signing.
• Generate your 24-word BIP39 seed with the built-in TRNG, import an existing seed, or use physical dice rolls (99 recommended).
• Export signed PSBTs via microSD card or NFC PushTx — your private keys never leave the device.

Dice-Roll Seed Generation

• If you don't trust Coinkite's TRNG, you can generate the BIP39 seed purely with dice. The Mk4 leads you through each roll (enter 1–6), mathematically encodes the rolls, and produces a verifiable seed phrase that is provably independent of any manufacturer-side randomness.
• Identity and key derivation math can be cross-verified offline; Coinkite documents the math publicly.

Trick PIN — Anti-Coercion Layer

• Duress PIN unlocks a separate wallet derived from your BIP39 words that cannot be linked back to your real funds — usable as a convincing decoy.
• Brick Me PIN permanently bricks the device on entry.
• Countdown to Brick forces a covert time-delay (minutes/hours/days) before login, then bricks the device.
• Login Countdown enforces a wait before any PIN can be entered.
• BIP39 Passphrase (25th word) support for hidden wallets.

Rugged Protective Sliding Cover

• Calculator-style sliding cover protects the OLED screen from damage and prevents hardware implants by covering the device when not in use.
• Coinkite's clear case version lets you visually inspect the PCB for added hardware a sneaky maid might have inserted.
• Comes in a range of colors so security doesn't have to look boring.

Dual Secure Element Key Storage

• Unlike wallets that trust the main microprocessor with the seed, the Mk4 stores the BIP39 master secret across two secure elements from different vendors: the Microchip ATECC608 and the Maxim DS28C36B, plus the main MCU.
• For funds to be compromised, a backdoor would need to exist across all three chips — an extraordinarily high bar against supply-chain attacks.
• The secure elements also enforce PIN retry limits and protect against brute-force attacks.

Genuine vs. Caution Lights

• Coinkite signs its firmware with a factory key. On boot, every byte of flash memory and the firmware signature are verified, and a green or red status light is set.
• The light's circuitry is dedicated hardware tied directly to a secure element — a rogue software routine cannot override it.
• The circuit lives on the exposed top surface of the device so any physical tampering to defeat the light is visibly obvious.

Anti-Phishing Words at Every Login

• The PIN is split into two halves (e.g. 1234-5678). After entering 1234, the Mk4 shows two unique words derived from secrets inside the secure element.
• Those words are unique per PIN prefix and per device — a cloned or trojan-horse COLDCARD cannot reproduce them.
• You memorize the words and check them before entering the second half of the PIN every single login.

Physical Security & Destruction

• The PCB is carefully designed to raise the cost of secure-element probing.
• The clear-case option lets you visually inspect for any hardware implant a maid could have inserted.
• There is no factory reset — if you forget your COLDCARD PIN there is no recovery path.
• Marked "SHOOT THESE" points guide effective physical destruction when it's time to retire the device.

Trick PIN Defenses

• Duress PIN unlocks a separate wallet derived from your BIP39 words but unreachable back to your real wallet — usable as a plausible decoy.
• Brick Me PIN permanently bricks the device on entry.
• Countdown to Brick enforces a covert time delay before login, then bricks.
• Login Countdown enforces a wait before any PIN attempt.
• BIP39 Passphrase (25th word) support adds hidden wallets above the main seed.

Coinkite is a Canadian bitcoin-hardware company founded in 2014 and headquartered in Toronto, Canada. Coinkite has been a Bitcoin-native brand since the earliest days of consumer hardware wallets and is most famous for the COLDCARD family — purpose-built, Bitcoin-only signing devices engineered around air-gapped PSBT workflows, dual secure elements and anti-coercion features like the Duress PIN.

Coinkite publishes the COLDCARD firmware open-source. The CC firmware is reproducible, the secure-element interactions are documented, and the hardware is sold without KYC — Coinkite never asks who you are or which serial number you bought. The company sells directly through store.coinkite.com and ships worldwide, often from regional fulfilment hubs so customers avoid import friction.

The COLDCARD Mk4 launched in 2021 and has since been succeeded by the Mk5, which keeps the same architecture (dual secure elements, NFC, microSD air-gap, sliding cover, numeric keypad) and adds an improved screen and keyboard. Coinkite also sells the larger COLDCARD Q with a QWERTY keyboard and bigger screen for power users.