Hardware wallet maker Coinkite has urged Coldcard Mk3 users to move their Bitcoin if their recovery seed was generated using specific firmware versions. The warning comes after security researchers identified a coordinated transfer of 594.48 BTC, worth about $38.2 million, although no confirmed link has been established between the wallet issue and the on-chain movement.
Firmware Versions Under Review
Coinkite said the issue affects recovery seeds created on Coldcard Mk3 firmware versions 4.0.1 through 5.0.3. The company stressed that its investigation is still ongoing.
According to the advisory:
- Coldcard Mk4, Mk5, and Coldcard Q are not affected.
- Wallets protected with a BIP-39 passphrase face minimal risk.
- The company clarified that a BIP-39 passphrase is different from the device PIN.
Users are being encouraged to migrate their funds as a precaution while the investigation continues.
$38 Million Bitcoin Transfer Sparks Questions
The warning arrived just as blockchain researchers spotted an unusual movement of funds.
AnchorWatch CEO Rob Hamilton reported that:
- 594.48 BTC moved across 500 transactions.
- The transfers involved 1,324 unspent transaction outputs (UTXOs).
- The activity took place within a three-block window.
- Around 562 BTC was later consolidated into a single address.
Hamilton’s initial assessment pointed to what “looked like flawed entropy” during wallet generation. However, he emphasized this was only a preliminary observation rather than a confirmed explanation.
No Proven Link Yet
Despite the timing, investigators have not confirmed that the Bitcoin sweep resulted from the Coldcard Mk3 firmware issue.
Wizardsardine CEO Kevin Loaec said low randomness during seed generation remains his leading hypothesis. He outlined several possible causes, including:
- A software library issue.
- A secure element problem.
- A specific hardware batch.
- A firmware-related flaw.
He also suggested an attacker may have searched a limited range of BIP-84 derivation paths, potentially explaining why many affected wallets used native SegWit addresses.
So far, no public technical report has identified the exact source of the vulnerability.
How Users Can Protect Their Funds
Coinkite recommends affected users generate a new recovery seed using an unaffected device, verify backups and receiving addresses, send a small test transaction first, and transfer the remaining balance only after confirming everything works correctly.
Users with only a Coldcard Mk3 can temporarily strengthen security by adding a unique BIP-39 passphrase. Advanced users may also generate a dice-only seed on firmware 4.1.9 using at least 99 rolls of a fair six-sided die, although the company warns this process requires careful backup and verification.
Investigation Continues
Coinkite has promised to publish a detailed technical review once its investigation is complete. Until then, both the company and independent researchers say the Coldcard Mk3 warning and the $38 million Bitcoin sweep should be treated as separate events, as no evidence currently proves they share the same root cause.
Was this writing helpful?
Story Ends Here
Trust with CoinPedia:
CoinPedia has been delivering accurate and timely cryptocurrency and blockchain updates since 2017. All content is created by our expert panel of analysts and journalists, following strict Editorial Guidelines based on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). Every article is fact-checked against reputable sources to ensure accuracy, transparency, and reliability. Our review policy guarantees unbiased evaluations when recommending exchanges, platforms, or tools. We strive to provide timely updates about everything crypto & blockchain, right from startups to industry majors.
Investment Disclaimer:
All opinions and insights shared represent the author’s own views on current market conditions. Please do your own research before making investment decisions. Neither the writer nor the publication assumes responsibility for your financial choices.
Sponsored and Advertisements:
Sponsored content and affiliate links may appear on our site. Advertisements are marked clearly, and our editorial content remains entirely independent from our ad partners.
Read the Next News
