Hardware wallet maker Coinkite has urged Coldcard Mk3 users to move their Bitcoin if their recovery seed was generated using specific firmware versions. The warning comes after security researchers identified a coordinated transfer of 594.48 BTC, worth about $38.2 million, although no confirmed link has been established between the wallet issue and the on-chain movement.
Firmware Versions Under Review
Coinkite said the issue affects recovery seeds created on Coldcard Mk3 firmware versions 4.0.1 through 5.0.3. The company stressed that its investigation is still ongoing.
According to the advisory:
- Coldcard Mk4, Mk5, and Coldcard Q are not affected.
- Wallets protected with a BIP-39 passphrase face minimal risk.
- The company clarified that a BIP-39 passphrase is different from the device PIN.
Users are being encouraged to migrate their funds as a precaution while the investigation continues.
$38 Million Bitcoin Transfer Sparks Questions
The warning arrived just as blockchain researchers spotted an unusual movement of funds.
AnchorWatch CEO Rob Hamilton reported that:
- 594.48 BTC moved across 500 transactions.
- The transfers involved 1,324 unspent transaction outputs (UTXOs).
- The activity took place within a three-block window.
- Around 562 BTC was later consolidated into a single address.
Hamilton’s initial assessment pointed to what “looked like flawed entropy” during wallet generation. However, he emphasized this was only a preliminary observation rather than a confirmed explanation.
No Proven Link Yet
Despite the timing, investigators have not confirmed that the Bitcoin sweep resulted from the Coldcard Mk3 firmware issue.
Wizardsardine CEO Kevin Loaec said low randomness during seed generation remains his leading hypothesis. He outlined several possible causes, including:
- A software library issue.
- A secure element problem.
- A specific hardware batch.
- A firmware-related flaw.
He also suggested an attacker may have searched a limited range of BIP-84 derivation paths, potentially explaining why many affected wallets used native SegWit addresses.
So far, no public technical report has identified the exact source of the vulnerability.
How Users Can Protect Their Funds
Coinkite recommends affected users generate a new recovery seed using an unaffected device, verify backups and receiving addresses, send a small test transaction first, and transfer the remaining balance only after confirming everything works correctly.
Users with only a Coldcard Mk3 can temporarily strengthen security by adding a unique BIP-39 passphrase. Advanced users may also generate a dice-only seed on firmware 4.1.9 using at least 99 rolls of a fair six-sided die, although the company warns this process requires careful backup and verification.
Investigation Continues
Coinkite has promised to publish a detailed technical review once its investigation is complete. Until then, both the company and independent researchers say the Coldcard Mk3 warning and the $38 million Bitcoin sweep should be treated as separate events, as no evidence currently proves they share the same root cause.