Coinkite, the manufacturer behind the Coldcard hardware wallet, has issued a precautionary warning advising owners of its Mk3 device generation to relocate their bitcoin holdings. The guidance comes as security researchers actively investigate a reported drain of approximately 594 BTC.

Coldcard is one of the most widely used bitcoin-only hardware wallets in the self-custody ecosystem, known for its air-gapped design and emphasis on private key isolation. A security advisory targeting a specific device generation from a manufacturer of this standing draws particular attention within the bitcoin community, where hardware wallets are typically relied upon as a final line of defense against theft.

The matter is being treated as an active investigation rather than a resolved incident. Coinkite has framed its advisory as a precautionary measure while the review remains ongoing.

Official Guidance and Scope

Coinkite issued its guidance through an official advisory, directing the notice specifically at owners of the Mk3 generation of the Coldcard device. The company recommended that affected users move their bitcoin to a secure location as a precautionary step. The Mk3 is a prior-generation device; Coinkite has since released newer hardware iterations, which may help explain why the warning is scoped to that particular model rather than the full product line.

The warning follows reporting by The Block indicating that experts are examining a large-scale bitcoin theft. According to the available reporting, the loss is believed to have occurred rapidly rather than over an extended period.

Atlas21 also reported on the incident, further documenting the scale and speed of the reported drain.

What has been confirmed at this stage is the existence of the warning itself and the fact that an investigation is underway. The precise cause of the drain, the exact mechanism of any exploit, the identity of any potential attacker, and whether every Mk3 unit is affected have not yet been established.

Outside Scrutiny and Open Questions

Bitcoin security researcher Jameson Lopp weighed in publicly on the incident, commenting on the case via X. His involvement underscores that the matter is being scrutinized by independent experts in addition to the manufacturer itself.

The reported figure of approximately 594 BTC sits at the center of the investigation. Researchers are actively examining the circumstances surrounding the loss, though key details remain unconfirmed.

For Mk3 owners, the relevance is direct: the investigation pertains specifically to the hardware generation they hold. This is why the guidance to move funds has been targeted at that particular model rather than the broader hardware wallet market.

Recommended Actions for Mk3 Owners

The core action communicated by Coinkite is straightforward: Mk3 users should move their funds. The company advises owners to verify the guidance directly through its official channels rather than relying on secondhand summaries.

Because the investigation is ongoing, official instructions may be updated as additional information emerges. Affected Mk3 owners are encouraged to confirm the official warning and follow the manufacturer's stated precautions.