Canadian Bitcoin hardware company Coinkite is warning users of the Coldcard Mk3 to transfer funds out of wallets that contain seed phrases created by firmware affected.
Coinkite will be available on Thursday. said Seeds created for an Mk3 that is running firmware version 4,0.1 (released in March 2021) or any Mk3 after this version could put your funds at risk. According to early analyses, this issue continues through firmware version 5.0.3 for the Mk3, but not the Mk4, Mk5, Q or Mk4.
Bitcoin security professionals are investigating a coordinated, unexplained sweep that involved 594.48 BTC coming from addresses using single-signature. No definitive evidence is available to prove that these transfers were caused by the Mk3 problem.
“Out of an abundance of caution,” Coinkite encouraged affected users generate a fresh seed, confirm the backup and address of their device and send a tiny test transaction. Then, move any remaining funds. The company stated that it is still investigating and has promised a formal review.
Coinkite has said that its initial analysis suggests that the seeds that are affected when they’re used with BIP39 passphrases face minimal risks. They stress that it is a BIP – 39 passphrase and not a Coldcard PIN.
Experts examine 594 BTC sweep
Reddit users brought attention to the sweep said A wallet that was seeded by a Coldcard Mk3 purchased in May 2021 had its funds drained.
It was reported that the seed of the Coldcard Mk4 had later been transferred to a Coldcard Mk4 Mk4 by a user in January 20, 2026. Therefore, it has now been entered on a new device. It is a self-reported account and there’s no evidence that Coldcard was involved in the sweep.
Rob Hamilton, CEO of AnchorWatch and its co-founder, posted a preliminarily analysis on Friday. said The 1,324 un-spent outputs of 500 transactions were spread across a 3-block window and moved 594.48 BTC.
According to the Bitcoin price at $64,364.07 when this was published, 594.48 BTC is worth around $38.3million. according CoinGecko.
Hamilton stated that all addresses were one-signature, and 562 BTC had been consolidated later into another address. “At a glance, this looks like there was flawed entropy in wallet generation somewhere along the way,” He wrote.
Related: Thousands of crypto wallets at risk from ‘Ill Bloom’ vulnerability: Coinspect
Separately, Wizardsardine CEO Kevin Loaec said His current hypothesis states that an insufficiently random random number generator in a device, software, or secure element, or a particular batch of devices or firmware, is responsible for the wallet seed.
He said that a malicious attacker, who was aware of this flaw, may have created an AI script and brute-forced affected wallets. However they only searched a narrow range of BIP 84-derived paths. It could be the explanation for why the sweep seems to have been concentrated at native SegWit wallets and some wallets are only partially depleted. Loaec, however, stressed that this theory has not yet been confirmed.
Loaec cautioned that, if he is right, wallets only partially empty may be vulnerable to further theft. The attacker could expose funds in any address type if he expands his scan.
Magazine: Inside the ‘fake police raid’ that forced a $1M Bitcoin transfer
“This article is not financial advice.”
“Always do your own research before making any type of investment.”
“ItsDailyCrypto is not responsible for any activities you perform outside ItsDailyCrypto.”
Source: cointelegraph.com
