Coldcard Mk3 Users Warned of Risk After 594 BTC Swept From 500 Addresses

The company said the latest advisory reflects its early analysis and that a formal technical review will follow.

Coinkite, the Canadian company behind the Coldcard hardware wallet, has warned users that Bitcoin funds may be at risk if their wallet seed was generated on certain affected firmware versions.

The company said the issue affects every Mk3 firmware release since version 4.0.1, released in March 2021, and is linked to the device-generated entropy used when creating seeds.

Funds Still at Risk

Seeds generated on Mk4 and Mk5 before firmware version 5.6.0, and on Q before version 1.5.0Q, are also affected, although Coinkite said the impact on those models is less severe but remains serious. According to the company, affected seeds have around 72 bits of entropy instead of the expected 128 bits. According to the update, TAPSIGNER, OPENDIME, and SATSCARD are not affected because they use different codebases.

Coinkite urged users with affected ones to migrate their funds to a newly generated seed on an unaffected device. The company said Mk4 and Mk5 users should first upgrade to firmware version 5.6.0 or later, while Q users should install version 1.5.0Q or later before generating a replacement seed.

Users were also advised to back up and verify the new seed, confirm a new receive address on the device, and send a small test transaction before moving the remaining funds. If the Mk3 is the only available option, it suggested temporarily using a strong, unique BIP-39 passphrase and carefully verifying the wallet fingerprint and receive address.

Large Scale Theft

The advisory came after several reports emerged on July 30 that Bitcoin had been drained from Coldcard wallets. Atlas21 reported that an automated operation swept 500 single-signature addresses across four consecutive blocks, from 960188 to 960191. The transactions moved 1,324 UTXOs totaling 594.5 BTC, which is worth around $38 million at current prices. Evidence pointed to weak private keys generated when the wallets were created.

No multisig or Taproot wallets were among the victims.

You may also like:

The median loss was 0.41 BTC, while 110 victims lost more than one Bitcoin. The largest loss was 29.9 units of the crypto asset, while the operation cost about 0.044 units in transaction fees. Atlas21 said the first public warning came from a victim on Reddit, who said their Coldcard had generated the 24-word seed phrase in 2021 and that the seed had never been entered on a computer.

Despite the massive drain, Bitcoin’s price remained unfazed as it continued to trade near $64,000.