TRUST.
TESTED.

No firmware-only remedy is established in the cited update. Follow the vendor’s current guidance for CryptoBilis purchasers. The full affected population and loss attribution remain unresolved.

Minimum corrected versions listed by Coinkite: Mk2/Mk3 4.2.0; Mk4/Mk5 standard 5.6.0; Q standard 1.5.0Q; Mk4/Mk5 Edge 6.6.0X; Q Edge 6.6.0QX. The advisory explains affected scope, an independent-dice exception and seed migration. Consult it before treating a wallet as remediated.

Donjon describes specialist equipment costing roughly $250,000 and reports no firmware update path for cards already in circulation. This is a laboratory attack requiring possession of a card, not a remote exploit or evidence of an in-the-wild theft campaign.

Tangem lists fixes in iOS 5.19.1 and Android 5.19.2. Its exposure scenario included contacting support through the app within seven days of seed-based activation. The vendor reported no losses and advised affected users to replace wallet keys; an update alone does not undo a prior exposure.

Trezor describes a strong passphrase as mitigation for the associated wallet because that passphrase is not stored on the device. This historical finding should not be generalized to Trezor’s Safe series or confused with a remote attack.

Coinkite released the fix in version 3.0.6 and published additional disclosure detail in March 2020. The vendor reported no evidence of malicious exploitation. This record concerns multisig validation, not the separate 2026 seed-generation incident.

ELLIPAL’s response says firmware 2.0 addressed the reported issues. The researcher’s claims and vendor’s assessment differ, so both are linked here. This record does not establish a vulnerability in Titan or Titan 2.0.