Coldcard OLED display leaks screen contents through USB power draw
Who is affected
An attacker with measuring equipment on a Coldcard Mk1/Mk2's USB power line could in theory recover parts of the PIN or recovery phrase while they are displayed. Coinkite considers the attack impractical and mitigated it in firmware 2.1.2.
What happened
On 7 August 2019, at the end of a coordinated embargo, security researcher Christian Reitter disclosed a side channel in hardware wallets with row-based OLED displays, including the Coldcard Mk1 and Mk2. It was assigned CVE-2019-14356 for the Coldcard; other vendors’ devices received separate CVEs.
According to NVD and Reitter, the power consumption of each display row depends on how many pixels are lit, and that draw can be measured on the USB connection without modifying the device. Reitter states that malicious equipment could recover significant portions of PIN codes or BIP39 recovery words while they are on screen; NVD describes it as a partial recovery of display contents.
Coinkite disputes the practical relevance: it calls the issue unproven and impractical, says an attacker would need hardware in the USB power source used during initial seed setup, and says the researcher provided only a few scope captures. It nonetheless changed firmware 2.1.2: PIN digits are no longer echoed (except on the touch-based Mk1), masking noise is drawn beside the seed words, and it said future hardware would get better USB power filtering.
Timeline according to Reitter: reported to Coinkite on 8 May 2019, CVE assigned on 28 July 2019, embargo ended on 7 August 2019.
A hardware wallet is a dedicated device that keeps private keys offline and signs transactions internally, so the keys never reach an internet-connected computer or phone.
Coldcard is an air-gapped hardware wallet for Bitcoin, made by Coinkite, that stores private keys offline and signs transactions without internet exposure.
PIN Protection is a security feature that requires a personal identification number (PIN) to access a cryptocurrency wallet or device, preventing unauthorized access.
Read full definitionBIP39 is a standard for generating mnemonic seed phrases that are used to create deterministic wallets and securely back up cryptocurrency private keys.
Read full definitionRecovery is the process of restoring access to a cryptocurrency wallet using its seed phrase or mnemonic backup if the original wallet is lost or inaccessible.
Read full definitionFirmware is the software that runs on a hardware wallet itself: it generates keys, shows transaction details on the screen and signs.
Read full definitionSources
Independent reporting and research this entry was checked against.
Learn more
Guides on protecting yourself against this type of incident (Hardware attack) and the glossary terms that describe it.
Can Hardware Wallets Be Hacked?
Hardware wallets are extremely secure, but not invincible. Understand the real risks and attack vectors.
Read GuideEvil Maid Attack: Protecting Unattended Hardware Wallets
Someone accesses your wallet while you are away. Hotel rooms, offices, shared spaces — how to detect and prevent physical tampering.
Read GuideProtecting Your Hardware Wallet from Physical Theft
What happens if someone steals your hardware wallet? How to set up layers of protection so theft alone cannot compromise your crypto.
Read GuideFault Injection
Fault injection disturbs a chip's voltage, clock or electromagnetic environment so that it skips a security check or leaks data.
Side-Channel Attack
A side-channel attack in cryptocurrency and blockchain targets indirect information, like power usage or timing, to extract sensitive data from a system or device.
Secure Element
A secure element is a tamper-resistant chip built to store secrets and resist physical attacks such as side-channel analysis and fault injection.
Evil Maid Attack
An evil maid attack is a physical security threat where an attacker gains temporary unsupervised access to a hardware wallet to tamper with it, install malicious firmware, or extract private keys.
Cite this entry
WalletInsights. “Coldcard OLED display leaks screen contents through USB power draw”. Hardware wallet security incident tracker. Last verified November 4, 2026. https://walletinsights.io/en/security-incidents/coldcard-oled-power-side-channel-2019/
Corrections and right of reply
Vendors, researchers and readers can send corrections or statements to security@walletinsights.io. We check them against the sources, update the entry and record the change in its log.
All Coinkite incidents
- COLDCARD firmware generated weak seeds
- COLDCARD Delta PIN mode let a private key be recovered from two signatures
- Ledger Donjon reads part of Coldcard Mk4's second secure element by double laser fault
- Ledger Donjon extracts Coldcard Mk3 secrets with multiple laser fault injections
- Coldcard registered multisig wallets without checking it was a cosigner