- Coldcard Mk3 security issue affects seeds created on firmware 4.0.1 and later.
- Around 594 BTC moved from 500 single-signature addresses.
- Coinkite recommends migrating funds to safer wallet setups.
A Coldcard Mk3 security issue has prompted warnings from hardware wallet maker Coinkite after researchers tracked a coordinated movement of about 594.5 BTC. The Bitcoin was drained from 500 single-signature addresses, although the company has not confirmed a direct connection between the transfers and the firmware issue.
Coinkite said users who created seeds on Coldcard Mk3 devices running firmware version 4.0.1 or later may face potential risks. The affected range extends through firmware 5.0.3, the final release supporting the Mk3 model.
Coldcard Mk3 Security Issue Linked to Seed Generation Review
The Coldcard Mk3 security issue centers on how wallet seeds were generated. Coinkite warned that funds connected to affected seeds could be exposed, while newer models including Mk4, Q and Mk5 are not affected based on the company’s early analysis.
The warning followed blockchain activity involving 594.48 BTC, valued at roughly $38 million at current prices. Rob1Ham on X observed the coins moving across Bitcoin blocks 960188 to 960191.
However, researchers have not confirmed that the wallet drains resulted from the Coldcard Mk3 security issue. Some security experts suggested weak randomness during seed creation as a possible explanation, but the exact cause remains under investigation.
Bitcoin developer James O’Beirne advised users with single-key wallets generated on affected Mk3 devices between 2021 and 2023 to move funds quickly. He highlighted additional protection methods such as passphrases, dice-generated seeds and multisignature setups.
Coldcard Mk3 Users Receive Migration Recommendations
Coinkite recommended that affected users create a new wallet using a strong BIP-39 passphrase and transfer funds to the new address. The company also advised users to verify backups and addresses before completing migrations.
Users with access to unaffected hardware wallets should generate a replacement seed and move assets carefully. Coinkite warned that rushed migrations could introduce additional security risks.
Meanwhile, advanced users can create a replacement seed on specific Mk3 firmware using a dedicated dice-roll method. The process requires at least 99 independent dice rolls to generate randomness without relying on the device’s random-number generator.
The Coldcard Mk3 security issue remains under review as Coinkite continues investigating the technical cause. Blockchain researchers are also examining whether additional transactions could be connected to the same event.
Disclaimer: This article is for informational purposes only and does not constitute financial advice. CoinCryptoNewz is not responsible for any losses incurred. Readers should do their own research before making financial decisions.