Bitcoin hardware wallet maker Coinkite has issued a security advisory warning that funds secured by seeds generated on certain Coldcard Mk3 devices may be at risk, as researchers investigate reports of coordinated Bitcoin wallet drains potentially involving hundreds of addresses.
The company said the issue affects seeds generated on Coldcard Mk3 devices running firmware version 4.0.1, released in March 2021, through version 5.0.3, the final firmware release supporting the Mk3.
Coinkite Issues Warning to Coldcard Mk3 Users
In its advisory published Thursday, Coinkite urged users who generated wallet seeds on affected Mk3 firmware versions to take precautionary measures.
According to the company’s preliminary investigation, newer Coldcard Mk4, Q and Mk5 devices are not affected.
Coinkite also said users who protected an affected seed with a strong BIP-39 passphrase appear to have significantly reduced exposure.
The company has not yet confirmed the precise technical cause of the issue and said its investigation remains ongoing.
Reports Point to Coordinated Bitcoin Wallet Drains
The warning followed reports on July 30 that Bitcoin had been unexpectedly transferred from multiple Coldcard-secured wallets.
According to a report from Atlas 21, approximately 594.5 BTC, valued at around $38.3 million, was moved from roughly 500 single-signature addresses through a coordinated series of transactions spanning Bitcoin blocks 960188 through 960191.
Coinkite has not confirmed that these transactions resulted directly from the Mk3 security issue.
However, some Bitcoin security researchers have suggested the incidents could potentially involve insufficient randomness, or weak entropy, in seeds generated by affected devices.
If seed generation is sufficiently predictable, an attacker could theoretically reconstruct private keys and gain control of the associated Bitcoin without physically accessing the hardware wallet.
Researchers Identify Potentially Larger Set of Transactions
Bitcoin developer James O’Beirne warned that users whose Bitcoin was protected by a single key generated on a Coldcard Mk3 between 2021 and 2023 could face elevated risk if they did not use additional protections such as dice-generated entropy, a BIP-39 passphrase or multisignature security.
While Coinkite’s preliminary findings exclude newer models such as the Mk4, O’Beirne suggested further investigation is necessary before the full scope is known.
Separately, Clay Garrett from Block’s engineering and security team identified another group of transactions displaying characteristics similar to the known wallet drains.
Garrett said 695 earlier transactions moved another 488.10957948 BTC.
If those transactions are ultimately connected to the same incident, the total amount potentially involved could reach approximately 1,082.59 BTC.
That broader connection, however, has not yet been confirmed.
Coinkite Recommends Immediate Security Measures
Coinkite has provided several options for Mk3 owners concerned about potentially affected seeds.
The company recommends creating a strong and unique BIP-39 passphrase and transferring funds to the resulting wallet as an immediate precaution.
For advanced users, Coinkite said an empty Mk3 running firmware version 4.1.9 can generate a replacement seed using the device’s dedicated dice-roll method.
The process requires at least 99 independent rolls of a fair six-sided die, allowing the wallet to derive entropy directly from the physical dice sequence rather than relying on the device’s random-number generator.
However, Coinkite said its preferred long-term solution is to migrate assets to a new seed generated on an unaffected Coldcard model.
Coinkite Urges Users Not to Rush Migration
Despite the potential security implications, the company cautioned users against moving funds hastily.
Wallet migrations involve handling seed phrases, addresses and transactions, meaning mistakes made while rushing could create a more immediate risk of losing funds.
Users should therefore carefully verify destination addresses and backup procedures before transferring assets.
Investigation Into Exact Cause Continues
The central question remains whether the reported Bitcoin drains are directly connected to the suspected Coldcard Mk3 seed-generation weakness.
Coinkite has not yet established that connection publicly and has not provided a definitive explanation for the underlying issue.
The company said it is continuing its investigation and plans to release additional technical details as they become available.
Until the cause and scope are established, the advisory represents a significant reminder of a fundamental hardware-wallet security principle: the security of cryptocurrency ultimately depends not only on protecting a private key, but also on ensuring that the randomness used to generate that key cannot be predicted or reproduced by an attacker.
