Coldcard

Coldcard is a signing device for bitcoin and nothing else. It comes from Coinkite Inc., a security outfit set up in Toronto in 2012, and the wallet line has been sold since 2017, according to the maker's site, checked on 5 August 2026. Two units are current: the Q, with a full keyboard and a QR camera, and the smaller Mk5, which signs through MicroSD and NFC. They were listed at 289 and 189 US dollars.

Keys are not trusted to the main processor. The 24-word master secret is split across two secure elements bought from different suppliers, so a weakness in one chip is not enough on its own. Firmware is published and reproducible, meaning a capable owner can rebuild a release and compare it with what shipped. At start-up the unit inspects its own flash memory and shows a GENUINE or CAUTION light before you type anything.

The coercion features are what set this product apart. The PIN comes in two halves; after the first half the screen shows two words unique to your unit, so a swapped lookalike cannot reproduce them. Beyond that sit trick PINs: one opens a decoy wallet, one forces a delay of minutes or days, and a third, the Brick Me PIN, destroys both secure elements and leaves the unit permanently dead. All are optional.

Buyers should understand the trade-off. There is no factory reset and no account with the manufacturer, so if the main PIN is forgotten Coinkite says nothing can be done; your written seed is the only way back to the coins. Signing can stay entirely off-line through QR, MicroSD, NFC or USB, and every route is switched off until you enable it. No companion app exists, so you drive it with coordinator software such as Sparrow or Nunchuk.

A device maker holds no customer funds and runs no exchange, so no financial licence applies and the absence of one tells you nothing about quality. What counts at purchase is provenance: buy direct or from a listed reseller, match the number on the tamper-evident bag against the number shown at first power-up, and avoid second-hand stock, which Coinkite advises against. Its security page notes that open source and reproducible builds make claims inspectable but fall short of an independent audit.