Coinkite has issued a warning to owners of its Coldcard Mk3 hardware wallet: any Bitcoin seed generated since March 2021 may be vulnerable due to a discovered flaw that could render those seeds predictable. Coldcard devices are marketed specifically for Bitcoin-only cold storage with air-gapped security, making a seed-predictability flaw particularly significant for users who chose the product for its hardened security model. The announcement coincided with a major incident in which approximately 594 BTC—valued at roughly $38 million—was drained from around 500 wallets.

Affected and Unaffected Models

The vulnerability is firmware-related, not hardware-related. According to The Block's Bitcoin engineering and security team, the Mk1 never ran the buggy code. Mk2 and Mk3 devices running firmware version 3.2.2 or later were initially generating seeds correctly using a hardware random number generator.

The vulnerability first appears in firmware version 4.0.0. Any Mk2 or Mk3 seed created using firmware versions 4.0.0 through 4.1.9 falls within a "confirmed vulnerable path," as the device failed to reseed its randomness source securely. Coinkite extends this warning through firmware version 5.0.3, the final firmware release supporting the Mk3.

Initially, Coinkite stated that only the Mk3 was affected, while newer models—the Mk4, Q, and Mk5—were described as "not affected based on our early analysis." However, in a subsequent notice, the company acknowledged that these newer models also generate seeds with only 72 bits of entropy rather than the intended 128 bits, though through a different mechanism owing to their distinct design. According to The Block, the Mk4, Q, and Mk5 draw entropy from a secure element but retain only four bytes of it, which limits the number of possible seed-generation paths.

Coinkite confirmed that its Tapsigner, Opendime, and Satscard products use entirely different codebases and remain unaffected.

The $38 Million Drain

The exploit unfolded rapidly. On Friday, approximately 500 wallets—each holding more than 0.15 BTC—were drained between 01:31 and 01:56 UTC. Many of these wallets had been inactive for years, with coin activity dating back to between 2021 and 2026.

Rob Hamilton, CEO of AnchorWatch, reported on X that he tracked 1,324 spent outputs across 500 transactions spanning three blocks, with 562 BTC subsequently consolidated into a single address.

The total may be higher. Block engineer Clay Garrett identified an additional 695 transactions bearing the same signature as the confirmed thefts, collectively moving approximately 488.1 BTC. If all linked transactions are included, the combined total could reach roughly 1,082 BTC. Coinkite has not yet verified whether the wallet drain was caused by the firmware flaw.

Technical Root Cause

Secure random number generation is foundational to all cryptocurrency key security; when it fails, seeds can potentially be derived from publicly observable information, collapsing the entire security model. The Block traced the issue to a firmware configuration that disabled the Mk3's hardware random number generator. A library used alongside the firmware checked only for the presence of the configuration setting—not whether it was enabled or disabled. As a result, key generation reverted to a software-based method that relied on publicly known values, including the device's serial number and clock registers.

Coinkite traced the problem to a code commit dated March 1, 2021, first incorporated into firmware version 4.0.0. The company stated that it disclosed the vulnerability before completing its full testing because "active exploitation is underway."

Recommended Actions for Owners

Coinkite's guidance depends on how each wallet was configured. According to the company's preliminary assessment, users who employed a separate BIP-39 passphrase in addition to a PIN face very little risk of losing funds—provided the passphrase was never entered into a smartphone, computer, or website.

All other users are advised to move their funds. Coinkite recommends creating a new seed on an uninfected device, verifying that backup and receive addresses are correct, sending a small test transaction first, and then transferring the remaining balance.

The company also describes an advanced dice-roll method that bypasses the device's random number generator entirely. However, Coinkite cautions users against acting in haste, noting that errors during recovery could cause more damage than the vulnerability itself.

Prospects for Recovery

Recovery of the stolen Bitcoin is not expected to be possible. Bitcoin transactions are irreversible by design, and while the blockchain's public ledger makes stolen funds traceable in principle, attackers frequently use mixing services or other techniques to obscure flows. The incident underscores the importance of evaluating hardware wallets based on verifiable criteria such as independent security audits, reproducible firmware, certifications, disclosure practices, and vulnerability response—factors particularly relevant in the wake of the Coldcard Mk3 incident.