Coldcard Mk3 Seed Flaw Warning After 594 BTC Moved From 500 Single-Signature Addresses

Hardware wallet maker Coinkite has issued a security warning for the Coldcard Mk3 after researchers flagged coordinated on-chain activity involving about 594.48 BTC, worth roughly $38 million at current prices. The funds were moved from 500 single-signature Bitcoin addresses. Coinkite has not confirmed that the transfers were directly caused by the Mk3 issue, and investigators have not established a definitive link. According to Coinkite, the risk applies to wallet seeds created on Coldcard Mk3 devices running firmware 4.0.1 or later. The potentially affected window runs through firmware 5.0.3, the last release that supports the Mk3 model. Coinkite said newer devices—Mk4, Q and Mk5—are not affected based on its early review. The concern centers on the Mk3 seed-generation process. Some security researchers have pointed to the possibility of weak randomness during seed creation, though the root cause remains under investigation. On X, Rob1Ham reported observing the BTC moving across Bitcoin blocks 960188 to 960191. Separately, Bitcoin developer James O'Beirne advised users who generated single-key wallets on impacted Mk3 devices between 2021 and 2023 to move funds promptly. He also recommended additional protections such as BIP39 passphrases, dice-generated seeds and multisignature configurations. Coinkite's guidance for potentially affected users is to create a new wallet—using a strong BIP39 passphrase—and transfer funds to new addresses. The company also urged users to verify backups and destination addresses before completing any migration, warning that hurried transfers can introduce new security risks. For advanced users, Coinkite noted an option to generate a replacement seed on specific Mk3 firmware using a dedicated dice-roll method. The approach calls for at least 99 independent dice rolls to supply entropy without relying on the device's random-number generator. Coinkite said its investigation is ongoing. Blockchain researchers are also reviewing whether additional transactions may be connected to the same incident. Disclaimer: This article is for informational purposes only and does not constitute financial advice. CoinCryptoNewz is not responsible for any losses incurred. Readers should do their own research before making financial decisions.