Coldcard: a firmware update does not remove the risk to a seed created on an affected version
The vendor reports: if a seed was generated on an affected firmware version and you continue to use the same seed, a subsequent firmware update does not remove the risk associated with how it was created — the migration steps must be followed. Researchers found the issue and reported it to the vendor; a detailed report is promised after the effectiveness of the measures is verified. Separately, the vendor warns of a wave of scam messages and “fixes”: neither a website nor someone offering help is ever entitled to ask for seed words, a passphrase or private keys.
If the seed was created on an affected version, consider it potentially weak: a firmware update is not enough — generate a new seed on your device and move funds to your own new addresses according to the vendor's migration instructions. Do not enter seed words, a passphrase or private keys on any websites or forms, or send them to anyone offering help; treat unsolicited messages and links with a “fix” as phishing.
Source: x.com - COLDCARDwallet