Goldshell – SD Card Firmware Recovery Flash Guide

Cold-power the miner for 60 seconds before touching anything else. A true brick survives a power cycle; a soft hang usually clears. If the LEDs change behavior (e.g. green starts blinking instead of solid), you are not actually bricked — check the Related Errors list first before starting a recovery flash.

Hold the reset button for 5-10 seconds via the RST pinhole on the rear of the BOX. Release, wait 60 seconds, observe. This triggers a bootloader-level reset that revives roughly 15% of apparent bricks where the miner daemon died but underlying firmware is intact. Always baseline a button hold before reaching for the SD card.

Check `find.goldshell.com` from a device on the same LAN as the miner. If the discovery tool finds it, your miner is alive at the bootloader level — the dashboard is gone but the network stack is not. That usually means web-UI corruption, not a full brick; a firmware re-upload over ethernet may be sufficient before doing a full SD recovery.

Email `hello@goldshell.com` requesting `burn-<model>.img`. Subject line: `Recovery image request — <model> — S/N <serial>`. Include exact model name (`KD-BOX` vs `KD-BOX Pro` vs `KD-BOX II` are different images), serial number, hardware revision if printed, and a one-line description of the failure. Expect a response in 24-72 hours with a CDN download link that expires in ~14 days.

Source a fresh `≥8 GB Class-10 microSD` card. SanDisk Industrial or Samsung Pro Endurance are the bench favorites; bargain cards fail mid-write at noticeable rates. Format as a single FAT32 partition — most cards ship this way, but if the card has been used for anything else, full-format it first, not quick-format.

Verify the image SHA-256 before flashing. `shasum -a 256 burn-<model>.img` on macOS/Linux, `Get-FileHash burn-<model>.img` in PowerShell. Compare against the hash Goldshell support provides. A mismatch means the download was corrupted — request a fresh link, do not flash. Flashing a corrupted recovery image produces a double brick that is dramatically harder to recover from.

Flash the image with balenaEtcher specifically (`etcher.balena.io`). Etcher is free, cross-platform, and — unlike Rufus or Win32DiskImager — validates the write by reading back and comparing hashes. Select the `burn-<model>.img` file, select the SD card, click Flash, wait 5-8 minutes for the write plus 5-8 for the verify pass. Do not cancel mid-write.

Power off the miner, insert the SD card, power on. Watch the LEDs: green solid followed by red flashing = recovery in progress. Total recovery time: 8-12 minutes for KD-BOX / HS-BOX / CK-BOX / ST-BOX, 12-20 minutes for Mini-DOGE III+ and larger BOX II variants. Do not interrupt — a mid-recovery power loss produces a NAND state that is much harder to revive than the original brick.

Watch the UART console during recovery if you have hardware access. Every Goldshell BOX has a 3-pin UART header (TX, RX, GND) on the control board — pinouts are on the James Chambers guide and the `goldshellminer/firmware` wiki. Hook up a USB-to-UART adapter at `115200 8N1`. Healthy recovery dumps `Burning uboot…`, `Burning kernel…`, `Burning rootfs…` each followed by OK. `CRC mismatch` or `bad block` means NAND is marginal — Step 13.

Try the recovery with a different SD card. Roughly 8% of failed-recovery cases in bench data are the SD card, not the miner. Use a second card from a different manufacturer if possible. Re-flash with Etcher, re-verify SHA-256, retry the full recovery process. If the second card also fails at the same point, the issue is not the card.

Try the recovery with a different PSU. Goldshell BOX miners are sensitive to voltage sag during the NAND write (the controller pulls current bursts). If your PSU is tired or under-spec, the write can fail silently. Swap to a known-good PSU — ideally a bench supply set to nominal 12V / 4A for most BOX variants — and retry the full recovery process.

Re-request the image from Goldshell specifying hardware revision as printed on the label (e.g. `HW v1.2`). Goldshell sometimes ships a hardware-revision-specific image and the first image they provide may be the wrong revision for your physical board. A wrong-revision image completes the write but boots to the same stuck-LED state.

NAND health check via UART. Interrupt u-boot at the boot prompt with a spacebar press within 2 seconds of power-up. Run `nand info` or `mtd` commands — inspect bad block counts. A board with >1% bad blocks has a dying NAND chip; recovery will fail repeatedly until the NAND is replaced, which is a BGA rework job. Stop DIY, proceed to Tier 4.

Post-recovery, re-flash to current stable firmware. The `burn-*.img` recovery image usually leaves the miner on an older baseline firmware. Once you are back at the web UI, upgrade over ethernet only (never WiFi) to the latest Goldshell stable — verify the target build against `github.com/goldshellminer/firmware/issues` first to avoid known-bad builds like `2.1.1`, `2.1.3`, `2.2.0`.

Stop DIY when you have attempted recovery with two SD cards, verified SHA-256 on the image, verified a known-good PSU, and the miner still will not complete the recovery write — or when the UART log shows persistent NAND CRC errors. At that point you are in control-board rework territory: failing NAND chip, damaged SoC NAND controller, or marginal power-rail capacitor. Book a D-Central ASIC Repair slot.

Ship safely to D-Central. Remove the SD card before packing (do not ship recovery media — send the image via email link instead). Pack the BOX miner in its original foam if available; otherwise use 5 cm+ of dense foam on every side plus an anti-static bag around the unit, double-boxed. Include a note with model, serial, observed LED pattern at failure, firmware version at failure, and any upstream event (WiFi upgrade, power outage, suspected malware) — every line saves diagnostic time.

At the D-Central bench: UART-level diagnosis, NAND chip-off read to salvage recoverable data before re-imaging, NAND replacement from matched-salvage inventory, full board recondition, and 24-hour hashing burn-in at nameplate before return. For malware-compromised units we also perform a full filesystem audit and re-key SSH host keys before returning the miner. Typical turnaround: 7-14 business days, ships Canada-wide.

Post-repair hardening. When the miner returns, change every default credential (the factory `123456789` password is widely published), close any port-forwarding you had on the device, and put the miner on a dedicated VLAN isolated from the rest of your network. The pool-hijack malware documented by Andreas Mai reached Goldshell BOX miners through default creds plus port-forward exposure — close both doors permanently.