SKN | Coldcard Warns Mk3 Users to Move Bitcoin After Potential Wallet Security Risk Emerges

• Coinkite has urged users of its Coldcard Mk3 hardware wallet to migrate funds if their recovery seeds were generated using affected firmware versions.
• The warning applies to Coldcard Mk3 firmware versions 4.0.1 through 5.0.3, while newer Mk4, Mk5 and Q devices are not affected.
• The alert comes as security researchers investigate an unexplained transfer of 594.48 BTC, worth approximately $38.3 million, from hundreds of single-signature Bitcoin wallets.
• Security experts have not confirmed that the Coldcard vulnerability caused the wallet drain, and investigations remain ongoing.

Canadian Bitcoin hardware wallet manufacturer Coinkite has advised users of its Coldcard Mk3 device to move their Bitcoin holdings if their wallet recovery seeds were generated using certain firmware versions.

According to the company, the potential issue affects seeds created on Mk3 devices running firmware version 4.0.1, released in March 2021, through version 5.0.3, the final firmware supporting the Mk3 hardware.

Coinkite emphasized that its Mk4, Mk5 and Coldcard Q devices are not impacted based on its current investigation.

The company described the advisory as a precautionary measure while engineers continue examining the issue.

Users Encouraged to Generate New Wallets

As a safety measure, Coinkite recommended that affected users create a new recovery seed using an unaffected hardware wallet.

The company advised users to verify the new backup and receiving address, perform a small test transaction and only then transfer their remaining Bitcoin holdings to the new wallet.

Coinkite also noted that wallets protected with a BIP-39 passphrase appear to face significantly lower risk. The company clarified that this refers to the optional recovery passphrase rather than the device’s PIN code.

A full technical report is expected after the investigation concludes.

Experts Investigate $38 Million Bitcoin Transfer

The warning coincides with an ongoing investigation into the coordinated movement of 594.48 Bitcoin, valued at roughly $38.3 million, from hundreds of single-signature wallets.

The incident first gained attention after a Reddit user reported losing funds from a wallet whose recovery seed had originally been generated on a Coldcard Mk3 purchased in 2021 before later being restored onto a newer Mk4 device.

While the report has fueled speculation, researchers have stressed that there is currently no confirmed evidence linking the Coldcard firmware issue to the broader Bitcoin transfers.

Security Researchers Explore Possible Causes

AnchorWatch CEO Rob Hamilton reported that approximately 1,324 unspent transaction outputs (UTXOs) were consolidated through 500 transactions across a narrow three-block period before eventually being merged into a single Bitcoin address.

Hamilton suggested the pattern could indicate flaws in wallet seed generation, potentially involving insufficient entropy during random number creation.

Separately, Wizardsardine CEO Kevin Loaec proposed that the incident may have involved a low-entropy random number generator within a software library, hardware component or specific firmware release.

According to Loaec’s preliminary theory, an attacker may have used automated tools to brute-force wallet seeds within a limited search space, although he emphasized that the hypothesis remains unconfirmed.

Investigation Continues

Researchers continue analyzing the incident to determine whether the wallet drain resulted from a hardware vulnerability, software issue or another previously unidentified security weakness.

Users whose wallets were only partially affected have been advised to remain cautious, as additional funds could potentially remain exposed if the underlying cause is confirmed.

For now, Coinkite recommends that any Mk3 users whose recovery seeds were generated using the affected firmware migrate their Bitcoin to newly generated wallets as a precaution.

Outlook

The Coldcard Mk3 advisory highlights the importance of hardware wallet security and ongoing vigilance within the Bitcoin ecosystem. While investigators have not established a direct connection between the reported firmware issue and the recent $38 million Bitcoin transfer, the incident serves as a reminder that strong entropy and secure key generation remain fundamental to digital asset protection. As investigations continue, affected users are encouraged to follow precautionary security guidance while the industry awaits definitive technical findings.