tags.
- Translate naturally, use appropriate crypto/tech terminology.
- Keep proper nouns like Coldcard, Coinkite, instagibbs, etc., in original form.
We'll translate each part.
Title: "Coldcard Mk3 Seed Generation Flaw Lets Attackers Recreate Keys, Coinkite Warns"
Translation: "Falha na geração de seed do Coldcard Mk3 permite que atacantes recriem chaves, alerta Coinkite"
Content: We'll translate each paragraph and heading.
First paragraph: "A flaw in the seed generation process of Coldcard Mk3 hardware wallets allows attackers to recreate private keys due to weak randomness sourced from button presses. Bitcoin Core contributor instagibbs reproduced the vulnerable seed on a newly initialized Mk3, confirming the risk. The vulnerability undermines the air gap that hardware wallets are supposed to guarantee — if an attacker can predict the seed, they can derive addresses and monitor for deposits without ever touching the device."
Translation: "Uma falha no processo de geração de seed das carteiras de hardware Coldcard Mk3 permite que atacantes recriem chaves privadas devido à aleatoriedade fraca originada de pressionamentos de botão. O colaborador do Bitcoin Core, instagibbs, reproduziu a seed vulnerável em um Mk3 recém-inicializado, confirmando o risco. A vulnerabilidade compromete o isolamento físico (air gap) que as carteiras de hardware deveriam garantir — se um atacante puder prever a seed, ele pode derivar endereços e monitorar depósitos sem nunca tocar no dispositivo."
Note: "air gap" is often translated as "isolamento físico" or "air gap" is used. We'll use "isolamento físico" for clarity, but sometimes it's kept as "air gap". We'll decide: "air gap" is a technical term, but in Portuguese it's often "isolamento físico" or "espaço aéreo" but that's not correct. Actually, in crypto context, it's often referred to as "air gap" even in Portuguese. We'll keep "air gap" in italics? But we need to translate naturally. I'll use "isolamento físico" to be more natural, but since it's a specific term, maybe keep "air gap" and explain? Actually, the translation requirement says "Use appropriate Portuguese terminology for crypto/tech terms". So we can use "isolamento físico" or "air gap" is also understood. I'll use "isolamento físico" to be more Portuguese.
Second paragraph: "
How the flaw works
"
Translation: "
Como a falha funciona
"
Then: "The Mk3 generates entropy by measuring the timing of user button presses during initialization. That randomness turned out to be far too predictable. The issue affects Mk3 devices running firmware 4.0.1 or later, as well as Mk4 and Mk5 units before firmware 5.6.0, and Q devices before version 1.5.0Q. Coinkite, the company behind Coldcard, published an advisory this week detailing the problem and urging users to migrate."
Translation: "O Mk3 gera entropia medindo o tempo dos pressionamentos de botão do usuário durante a inicialização. Essa aleatoriedade revelou-se muito previsível. O problema afeta dispositivos Mk3 com firmware 4.0.1 ou posterior, bem como unidades Mk4 e Mk5 antes do firmware 5.6.0, e dispositivos Q antes da versão 1.5.0Q. A Coinkite, empresa por trás do Coldcard, publicou um aviso esta semana detalhando o problema e pedindo que os usuários migrem."
Third paragraph: "
Who is affected
"
Translation: "
Quem é afetado
"
Then: "The highest-risk profile is a Mk3-generated seed used in a single-signature setup with no BIP-39 passphrase, no dice entropy, and no multisig. A strong passphrase adds an independent barrier, but Coinkite still recommends migration. Multisig setups confine the risk to one signer — if the other keys are independent, the overall wallet remains safe. User-supplied dice entropy can mitigate the flaw, but only if at least 50 fair rolls were used; fewer rolls or any uncertainty still requires a full migration."
Translation: "O perfil de maior risco é uma seed gerada no Mk3 usada em configuração de assinatura única, sem frase-senha BIP-39, sem entropia de dados, e sem multisig. Uma frase-senha forte adiciona uma barreira independente, mas a Coinkite ainda recomenda a migração. Configurações multisig limitam o risco a um signatário — se as outras chaves forem independentes, a carteira geral permanece segura. Entropia fornecida pelo usuário via dados pode mitigar a falha, mas somente se pelo menos 50 lançamentos justos forem usados; menos lançamentos ou qualquer incerteza ainda exigem migração completa."
Note: "dice entropy" is "entropia de dados" (dados = dice, but careful: "dados" means dice in Portuguese, but also data. We'll use "entropia de dados" but it might be ambiguous. Actually, "dice" is "dado" (singular) and "dados" (plural). But "dados" also means data. We can say "entropia de lançamentos de dados" or "entropia por dados" but it's okay. Alternatively, we can say "entropia de dados" and it's understood in context. We'll use "entropia de dados" but we might need to clarify. Since the original says "dice entropy", we can translate as "entropia de dados" but it might be confused with data. Actually, in crypto context, "dice" is often used for dice rolls. We'll use "entropia de lançamentos de dados" to be clear. But we'll keep it simple: "entropia de dados" is fine, but I'll change to "entropia de lançamentos de dados" for clarity. However, the requirement is natural translation, so we can say "entropia de dados" and it's understood. I'll use "entropia de dados" but we might need to mention "dados" as dice. Actually, in Portuguese, "dado" is the die, and "dados" are the dice. So it's fine.
Fourth paragraph: "
What users need to do
"
Translation: "
O que os usuários precisam fazer
"
Then: "There is no firmware fix that can change existing keys. The only remedy is to generate a new seed on an unaffected device and transfer all funds. Coinkite recommends verifying the backup, fingerprint, and receive address, then sending a test payment before moving the full balance. The advisory covers Mk3 devices manufactured from March 2021 onward, with the final Mk3 firmware released in June 2023 — meaning there is a roughly three-year window during which dormant holders may still be using vulnerable seeds."
Translation: "Não há correção de firmware que possa alterar chaves existentes. A única solução é gerar uma nova seed em um dispositivo não afetado e transferir todos os fundos. A Coinkite recomenda verificar o backup, a impressão digital e o endereço de recebimento, e depois enviar um pagamento de teste antes de mover o saldo total. O aviso abrange dispositivos Mk3 fabricados a partir de março de 2021, com o último firmware Mk3 lançado em junho de 2023 — o que significa que há uma janela de aproximadamente três anos durante a qual detentores inativos ainda podem estar usando seeds vulneráveis."
Fifth paragraph: "
The three-year gap
"
Translation: "
A lacuna de três anos
"
Then: "That gap is the real worry. Anyone who bought a Mk3 in 2021 or 2022, set it up, and then put it in a drawer may not have updated firmware or thought about seed generation. Coinkite's warning is clear: if you have a Mk3 seed generated during that period, assume it is compromised. The company advises moving funds to a new wallet generated on a Mk4, Mk5, or Q device with the latest firmware, or using a different hardware wallet entirely."
Translation: "Essa lacuna é a verdadeira preocupação. Quem comprou um Mk3 em 2021 ou 2022, configurou e depois guardou em uma gaveta pode não ter atualizado o firmware ou pensado na geração de seed
