Coinkite, the manufacturer behind the Coldcard hardware wallet, has issued a warning to users of its Coldcard Mk3 device following reports linking the older-generation product to a theft of approximately 594 BTC. The company is urging Mk3 holders to exercise caution as further details emerge.

The alert targets specifically the Coldcard Mk3, an earlier iteration of Coinkite's Bitcoin-only signing device. The Coldcard product line is designed for air-gapped operation, meaning signing can be performed without a direct USB or network connection. The Mk3 has since been superseded by the Mk4, Coinkite's current flagship model. The warning comes in response to reports of a 594 BTC theft — a sum that, if confirmed, would rank among the largest single self-custody losses reported this year.

At this point, the incident remains based on reports rather than a fully verified forensic account. Coinkite's response signals that the company is treating the matter as active and ongoing. However, the precise attack vector has not yet been independently established based on the available evidence.

Significance for Bitcoin Self-Custody

Because the loss is denominated in BTC, it falls directly within the concerns of Bitcoin holders who depend on hardware wallets instead of exchange-based custody. A theft of this magnitude from a self-custody configuration strikes at the central value proposition of devices like the Coldcard: keeping private keys isolated from online threats.

Hardware wallets are promoted as a safer alternative to storing cryptocurrency on a centralized platform. Users routinely weigh this option against the custody services provided by centralized exchanges. A reported incident involving a recognized product line can alter perceptions of that trade-off, even before any technical root cause is confirmed. Hardware wallet incidents have historically stemmed from a range of causes — including supply-chain tampering, compromised seed phrase handling, and firmware vulnerabilities — making it difficult to assess individual risk without a confirmed root cause.

Reports alone can influence user behavior. Owners of the affected model may decide to migrate funds, rotate keys, or upgrade their hardware while awaiting clarity. Incidents that pair a large BTC figure with a specific device tend to draw heightened scrutiny toward wallet security practices.

What Coldcard Mk3 Users Should Monitor

The immediate priority for affected users is to follow updated guidance issued directly by Coinkite. Since the company has already released a warning, subsequent statements clarifying the scope, potentially affected firmware versions, or recommended mitigations are the details most worth tracking.

It is critical to distinguish confirmed information from developments still in progress. The established facts are that the Coldcard Mk3 is the device in question and that Coinkite has issued a formal warning. The specific mechanism behind the reported theft remains an unverified claim drawn from early reports and should be treated accordingly until confirmed.

Security incidents occur against a broader backdrop of pressure across the Bitcoin market, including corporate treasury losses linked to price declines and wider macroeconomic strains affecting cryptocurrency markets. For individual holders, however, the practical takeaway remains focused: verify your own hardware setup, follow official manufacturer updates, and avoid acting on unverified details.

Based on the available evidence, Coinkite has not yet published a final technical breakdown explaining how the reported funds were taken. Until such an analysis is released, Coldcard Mk3 users are best served by measured caution rather than alarm, and by relying on the manufacturer's official channels for any instructions.