Coinkite

• Name: Coinkite
• URL: https://coinkite.com/
• Category: bitcoin hardware-wallet company / signer-firmware vendor / bearer-bitcoin product operator / self-custody supply-chain and release-trust boundary
• Tags: bitcoin-ecosystem
• Summary: Coinkite belongs as an entity note, not primarily as a protocol note. The useful question is who designs and ships the COLDCARD line, signs and distributes firmware, defines the airgapped PSBT workflow, publishes the hardware and internal-docs surface, and extends the same signer philosophy into OPENDIME, SATSCARD, TAPSIGNER, and CKBunker. The practical leverage sits with the company-run signer lifecycle: hardware design choices, firmware provenance, backup and Seed XOR workflow, product-line distribution, and the release-and-documentation pipeline users actually trust.
• What it does:
  • Builds the COLDCARD Q and Mk5 Bitcoin signing devices with airgapped transaction-signing flows and Bitcoin-only scope
  • Publishes open-source COLDCARD firmware and a simulator, with reproducible-build instructions for users who want to verify shipped binaries
  • Maintains internal technical docs covering PIN-entry design, backup-file formats, Electrum and Bitcoin Core usage, Seed XOR, developer access, and documented limitations
  • Shares hardware schematics and bills of materials for multiple COLDCARD revisions for security research and testing
  • Sells adjacent Bitcoin-native hardware and bearer instruments including OPENDIME, SATSCARD, TAPSIGNER, SEEDPLATE, and BLOCKCLOCK products
  • Operates CKBunker, a Coldcard-attached HSM-control program for unattended signing workflows
• Key claims:
  • Coinkite’s main site positions the company as a broader Bitcoin security-and-hardware maker, not just the steward of one wallet SKU, which is why the entity boundary matters more than a narrow device note
  • The COLDCARD homepage says the device is Bitcoin-only, stores seeds in dual secure elements from different vendors, and is designed for fully airgapped use via MicroSD, NFC, and QR transfer paths
  • The firmware repo emphasizes reproducible builds with exact-byte verification against released binaries, which is one of the clearest first-party signals that firmware release provenance is a real company-controlled trust surface
  • The internal-docs repo is unusually rich for a hardware-wallet vendor because it openly documents PIN-entry architecture, encrypted backups, Seed XOR, Bitcoin Core and Electrum workflows, and policy limitations
  • The hardware repo is also notable because Coinkite publishes schematics and BOM files for several device revisions, explicitly to aid security researchers, even while restricting commercial reuse
  • Coinkite’s broader product line matters for classification: OPENDIME, SATSCARD, TAPSIGNER, and CKBunker show the company is building a family of Bitcoin custody, bearer-instrument, and signing tools rather than only a standalone wallet
  • The public research and verification surfaces make Coinkite look more like a named self-custody operator boundary than a generic hardware wallet brand
• Whitepaper: No canonical company whitepaper is the important artifact here. The strongest primary materials remain the official company site, COLDCARD docs/homepage, and the public firmware / docs / hardware repositories already captured in ../whitepapers/coinkite-primary-sources-2026-05-01.md.
• Sources:
  • https://coinkite.com/
  • https://coldcard.com/
  • https://coldcard.com/docs/
  • https://github.com/Coldcard/firmware
  • https://github.com/Coldcard/firmware/blob/master/docs/README.md
  • https://github.com/Coldcard/firmware/blob/master/hardware/README.md
  • https://ckbunker.com/

Internal linkages

• Project-layer alias: coinkite.
• Keep the strongest adjacent signer-stack comparisons on foundation-devices, ledger, and bitkey.
• Reusable lens: hardware-wallet notes often need a separate company cut because firmware signing, hardware provenance, backup choreography, companion tooling, and supply-chain trust usually sit with one named operator.

Control surface

• Practical authority sits in hardware design decisions, firmware release and signing workflow, build provenance, PIN-entry and secure-element tradeoffs, backup-file and Seed XOR guidance, and the documentation that shapes how users verify and operate the signer.

• Even in a strongly airgapped model, users still depend on Coinkite for the firmware-distribution path, product and accessory lifecycle, CKBunker-style unattended-signing tooling, and the broader product-family assumptions the company normalizes around Bitcoin custody.

• Treat Coinkite as a self-custody operator boundary: the important question is not just what can COLDCARD do? but who controls the signer lifecycle and trust pipeline around COLDCARD and Coinkite's wider hardware stack?

• Last reviewed: 2026-08-06 UTC