Coldcard flags possible seed risk for Mk3 users as $38.2M BTC "sweep" draws scrutiny

Coinkite, the maker of the Coldcard hardware wallet, is advising Coldcard Mk3 owners to move their bitcoin if their recovery seed was created on certain firmware releases. The alert follows reports from security researchers of a coordinated on-chain transfer totaling 594.48 BTC, valued at roughly $38.2 million, though no confirmed connection has been established between the wallet advisory and the fund movement. Affected firmware range Coinkite said the concern applies to recovery seeds generated on Coldcard Mk3 firmware versions 4.0.1 through 5.0.3, noting its investigation remains ongoing. The company said Coldcard Mk4, Mk5 and Coldcard Q are not impacted. Wallets that use a BIP39 passphrase face minimal risk, and Coinkite stressed that a BIP39 passphrase is distinct from the device PIN. As a precaution, the firm is encouraging users to migrate funds while the review continues. Unusual $38.2 million transfer The advisory coincided with blockchain analysts flagging a burst of activity. AnchorWatch CEO Rob Hamilton said 594.48 BTC moved via 500 transactions, spanning 1,324 unspent transaction outputs (UTXOs) within a three-block window, with about 562 BTC later consolidated into a single address. Hamilton said an early read suggested what "looked like flawed entropy" during wallet generation, while emphasizing it was not a confirmed finding. No confirmed link Despite the timing, investigators have not verified that the bitcoin sweep resulted from the Coldcard Mk3 firmware issue. Wizardsardine CEO Kevin Loaec said insufficient randomness during seed creation remains his leading hypothesis, citing several potential sources: a software library issue, a secure element problem, a specific hardware batch, or a firmware-related flaw. He also suggested an attacker may have searched a constrained set of BIP84 derivation paths, which could help explain why many of the potentially affected wallets used native SegWit addresses. No public technical report has yet identified the root cause. Steps to protect funds Coinkite recommends users believed to be affected create a new recovery seed on an unaffected device, verify backups and receiving addresses, send a small test transaction, and transfer the remaining balance only after confirming everything works. Users who only have a Coldcard Mk3 can add a unique BIP39 passphrase as an interim measure. Advanced users may generate a dice-only seed on firmware 4.1.9 using at least 99 rolls of a fair six-sided die, though Coinkite cautioned the method requires careful backup and verification. Review pending Coinkite said it will publish a detailed technical write-up after the investigation concludes. For now, the company and independent researchers are treating the Coldcard Mk3 advisory and the $38.2 million bitcoin sweep as separate developments, citing a lack of evidence that they share the same cause.