Hardware review — Coldcard
Coldcard Q review: uncompromising, and unforgiving
The Coldcard is the highest security architecture score on this site and the lowest interface score. Those two facts are the same fact. It is built for people securing amounts where reading documentation is a reasonable price, and it does not pretend otherwise.
- 9.6/10 Highest security architecture score here
- 2 Independent secure elements
- BTC only One asset, minimal firmware
- Tauranga Stocked domestically by The Bitcoin Shop
At a glance
The most paranoid device you can buy, and the least forgiving interface — that trade is the whole point.
Best for: Serious Bitcoin-only holders and multisig builders · Maker: Coinkite (Canada)
The premise: your computer is already compromised
Every hardware wallet is built on an assumption about the world, and the assumption determines the product. Most devices assume your laptop is probably fine and their job is to keep the key out of it. Coldcard assumes your laptop belongs to somebody else, your companion software may be lying to you, and the parcel courier might have opened the box.
Follow that premise honestly and you arrive at the Coldcard. If the host cannot be trusted, the device must verify Bitcoin transaction data itself rather than accepting what the wallet software claims a transaction does — so it does, and it is the only consumer device that does. If the cable is a risk, there must be a way to operate with no cable at all — so there is, through microSD and the Q's built-in QR scanner. If an attacker might get the device, one secure element is not enough — so there are two, plus a PIN that permanently bricks them.
This is why the Coldcard scores 9.6 on security architecture and 6.3 on interface. Those numbers are not in tension; the second is the price of the first. A device that refuses to trust anything cannot also be effortless, because most of what makes software effortless is trusting things on the user's behalf.
Specifications
| Maker | Coinkite, Canada |
|---|---|
| Price | US$239 for the Coldcard Q |
| Form factor | Full keyboard, large screen, built-in QR scanner |
| Secure elements | Dual secure elements |
| Source code | Source-available firmware, with reproducible builds |
| Connection | microSD, QR code scanning, NFC — full air-gap operation possible with no cable ever |
| Asset support | Bitcoin only |
| Verification | Verifies Bitcoin transaction data on the signer rather than trusting the host |
| Backup | BIP39 recovery phrase, passphrase, encrypted backup to microSD, seed splitting |
| Special features | Duress PIN opening a decoy wallet; brick PIN that destroys the secure elements; multisig support |
| NZ availability | The Bitcoin Shop (Tauranga), or direct from coldcard.com |
| Last verified | September 2026 |
On-device verification: the thing nobody else does
This is the technical distinction most worth understanding, because it is where Coldcard genuinely separates from the field rather than just doing the same job with more chips.
When you sign a Bitcoin transaction on a typical hardware wallet, the device is shown a transaction structure by the host software and displays the amounts and destinations it has been told about. That is a substantial improvement over signing blind — the device's screen is driven by its own firmware, so simple clipboard attacks fail. But the device is still, in a limited sense, taking the host's word about the inputs.
Coldcard verifies the underlying Bitcoin data on the signer. In practice this closes a class of attack in which a malicious host constructs a transaction that appears innocuous on the device screen while actually spending more than displayed, typically by misrepresenting the inputs so that an unexpectedly large change output goes to the attacker. It is a subtle attack, it has been demonstrated in research contexts, and Coldcard is the device that structurally cannot fall for it.
Does this matter to you? If you hold a modest amount and use mainstream software, probably not. If you are securing a life-changing position, the answer is that you are paying US$239 to remove a category of risk that you would otherwise have to reason about, and that is a reasonable purchase.
Air-gap, properly
The Coldcard Q can be operated so that it never connects to anything. Two workflows support this.
The microSD workflow is the original: your wallet software writes an unsigned transaction file to a card, you move the card physically to the Coldcard, it signs, and you carry the card back. Slow, entirely deterministic, and the only data that ever crosses the gap is a file you can inspect.
The QR workflow, new to the Q, uses the built-in scanner and the larger screen to do the same thing visually — considerably faster, and the reason we would choose the Q over the smaller Mk4 for most people. Functionally it is the same pattern Keystone uses, with the difference that Keystone has no other option while Coldcard treats QR as one of several.
Either way, the device can spend its whole life having never touched a computer. For a long-horizon Bitcoin holding, that is the strongest position available.
Duress PINs and physical coercion
Coldcard supports a duress PIN that opens a separate decoy wallet with a plausible small balance, and a brick PIN that permanently destroys the secure elements. These exist for the scenario where someone is standing over you demanding you unlock your wallet. It sounds paranoid until you remember what followed the 2020 Ledger customer address leak — extortion letters, and physical threats. For most New Zealand holders this is over-engineering. For someone whose address appeared in that data, it is not.
The balance sheet
What we like, and what we don't
What it does well
- The most rigorous consumer signing device available — dual secure elements and a design premised on your computer already being compromised
- Verifies Bitcoin transaction data on the device itself rather than trusting what the host software claims
- Full air-gap operation possible with no cable ever connected, via microSD or the built-in QR scanner
- Bitcoin-only firmware means a small, heavily reviewed codebase with no altcoin attack surface
- Best-in-class multisig support, which is why it appears in most serious multi-key setups
- Duress PIN and brick PIN provide real answers to physical coercion scenarios
- Genuinely available in New Zealand through The Bitcoin Shop in Tauranga
What we hold against it
- The interface will lose most first-time users; this is a device that expects you to read the manual
- Bitcoin only — useless if you hold anything else
- US$239 is expensive relative to devices that are adequate for the same job
- Source-available rather than fully permissive licensing, which some purists object to
- Setup takes materially longer than any other device here, and the failure modes of getting it wrong are real
- The feature set — duress PINs, seed splitting, brick PINs — creates opportunities to lock yourself out that simpler devices do not have
Where the Coldcard really belongs: multisig
If we had to name the single best use of a Coldcard, it would not be as somebody's only wallet. It would be as one key in a two-of-three multisig arrangement, and the device's multisig support is the best in the category by some margin.
The logic of multisig is that a single device and a single recovery phrase are both single points of failure. Spread the requirement across three keys held in different places, require any two to spend, and you have a wallet that survives losing one key, survives one device being compromised, survives one backup being destroyed, and gives your executor a workable path if you die. Using devices from different manufacturers also means a firmware flaw or supply-chain compromise affecting one brand cannot spend your funds alone.
A Coldcard plus a Trezor plus a Keystone, coordinated through Sparrow Wallet on a desktop, is about as robust as a private individual can reasonably build. It is more work to set up than a single device — genuinely a weekend project the first time — and for amounts above roughly NZ$100,000 we think it is the correct answer.
Buying a Coldcard in New Zealand
Unusually for a device this specialised, you can get one domestically. The Bitcoin Shop, dispatching from Tauranga, stocks the Coldcard Q as part of a Bitcoin-focused range that also includes Blockstream Jade, Trezor and TinySeed steel backup plates. Orders ship with tamper-evident seals, and payment options include Bitcoin, Lightning, card, Afterpay and bank transfer. That gives you a one to three working day delivery instead of a multi-week import, plus cover under the Consumer Guarantees Act 1993.
Buying direct from Coinkite in Canada is also fine and is what many people do. Fifteen percent GST is normally collected at checkout for goods under NZ$1,000, plus the NZ$2.21 Customs Low-Value Goods levy and GST from 1 April 2026. Expect one to three weeks. Given the choice, we would use the local reseller — the delivery is faster, the warranty path is local, and your street address stays in a New Zealand company's records.
An honest warning about complexity
We have praised this device throughout and we want to close with a caution, because the Coldcard has a failure mode its competitors do not.
Simpler devices are hard to lock yourself out of. There is a PIN, there is a recovery phrase, and that is roughly the whole state space. The Coldcard has PINs, duress PINs, brick PINs, passphrases, seed splitting, encrypted microSD backups and multisig configurations. Every one of those is a genuine capability, and every one of those is something you can misconfigure in a way that makes your funds permanently inaccessible — not stolen, just gone, because you are the person who locked the door.
So if you buy one: set it up with nothing on it, read the documentation properly, use the smallest set of features that meets your actual needs, and complete a full wipe-and-restore before funding it. Write down what you configured, not just the seed words, and keep that note with your backup. A Coldcard rewards care and punishes improvisation, which is precisely what you would want from an instrument designed for serious amounts.
From our testing notes
Every non-technical tester we handed a Coldcard to gave up. Every technical tester ended up admiring it. That split is the review in miniature, and it is why we grade it AA while sending most readers to a Trezor. The best device in the world is the one you will still be using correctly in five years, and for the large majority of people that is not this one.
Coldcard Q FAQ
Coldcard Q — questions New Zealanders ask
Is the Coldcard too complicated for a beginner?
Honestly, yes — and we say that as its strongest admirers. The Coldcard is a keyboard-and-menu device built by people who assume you will read the documentation, and it will lose most first-time users inside ten minutes. If this is your first hardware wallet, buy a Trezor Safe 5 or a Ledger Nano S Plus, learn what a seed phrase and a derivation path are, and come back in a year if you still want the most rigorous device available.
Why is Coldcard Bitcoin only?
Because every additional chain is additional code, and additional code on a device holding your keys is additional risk. Supporting one asset means the firmware is small enough to be reviewed thoroughly, and Coldcard goes further than its peers by verifying Bitcoin transaction data on the signer itself rather than trusting what a companion app claims a transaction does. If you hold assets other than Bitcoin you need a different device; if you hold only Bitcoin, this constraint is the product's greatest strength.
Can I buy a Coldcard in New Zealand?
Yes — The Bitcoin Shop, dispatching from Tauranga, stocks the Coldcard Q as part of its Bitcoin-focused range alongside Blockstream Jade, Trezor and TinySeed steel backups, with tamper-evident seals and payment by Bitcoin, Lightning, card, Afterpay or bank transfer. That makes it one of the few genuinely serious devices available domestically. You can also import direct from Coinkite in Canada, which takes roughly one to three weeks.
What is the difference between the Coldcard Q and the Mk4?
The Q adds a full keyboard, a larger screen and a built-in QR code scanner, which makes air-gapped operation considerably more practical — you can scan an unsigned transaction and display the signature without ever inserting a card or a cable. The Mk4 is smaller, cheaper and relies on microSD and NFC for air-gapped workflows. Both share the dual secure element architecture and the same firmware philosophy. For most buyers the Q's QR scanner and keyboard are worth the difference.
What is duress mode and do I need it?
Coldcard supports a duress PIN that opens a separate decoy wallet, and a brick PIN that permanently destroys the device's secure elements. The intended scenario is being physically coerced into unlocking your wallet: you enter the duress PIN, a plausible small balance appears, and your real holdings stay hidden behind a different PIN. Most people do not need this. Anyone whose name and address has appeared in a hardware wallet vendor's data breach, or who is publicly known to hold significant crypto, might reasonably think differently.
Next in this cluster