Coldcard Mk3 Owners Told to Move Coins After 594 Bitcoin Swept From Dormant Wallets

On July 30, roughly 594 bitcoin, worth about $38 million, moved out of approximately 500 single-signature addresses within about 25 minutes, draining some 1,324 unspent outputs across a three-block window. Many of the drained coins had not moved since 2021. The pattern points not to a stolen password or a phishing attempt but to a flaw in how the keys were created.

Coinkite, the maker of the Coldcard hardware wallet, issued a warning to owners of its older Mk3 device running firmware versions 4.0.1 through 5.0.3, saying seeds generated on those units may be at risk from a flaw in the device's random-number generator. On-chain investigators reached the same early conclusion, that faulty entropy in wallet generation is the most likely root cause. When the randomness that seeds a private key is predictable, an attacker can regenerate the key space and reconstruct addresses that their owners believed were mathematically impossible to guess.

The attack vector here is cryptographic, not a smart-contract bug and not a server breach. Because the coins were self-custodied bitcoin moving in valid signed transactions, no protocol or exchange can freeze or reverse them, and none of the funds have been recovered or attributed. Coinkite says its newer Mk4, Q and Mk5 devices are not affected, and that wallets protected by a separate optional passphrase (a BIP-39 passphrase) face minimal risk. Developers on Bitcoin's technical forums are still examining whether every drained wallet shares the Mk3 as a common origin, so the link between the specific firmware warning and the full sweep remains probable rather than proven.