594 BTC drained in 25 minutes as Coldcard flaw sparks alarm

Coinkite has warned owners of its Coldcard Mk3 hardware wallet that any Bitcoin seed generated since March 2021 may be vulnerable after discovering a flaw that could make those seeds predictable. The warning came the same day about 594 BTC—worth roughly $38 million—was drained from around 500 wallets.

Users who purchased Coldcard primarily for its security features will right away want to know which models still maintain safety. At first, Coinkite only stated that the Mk3 was affected while new models like Mk4, Q, and Mk5 were dubbed “not affected based on our early analysis,” as stated by The Block. However, in its later notice, the company mentioned that those newer models also create seeds with only 72 bits of entropy instead of 128 bits as was originally intended, albeit in a different way because of a different design.

Which Coldcards are safe, and which are not

The problem is associated with the firmware, not with the hardware.

As reported by Block’s Bitcoin engineering and security team, Mk1 had never run buggy code. Also, Mk2 and Mk3 devices with firmware upgraded to 3.2.2 or later were generating their seed properly using a hardware random number generator.

The vulnerability begins with the firmware version 4.0.0. Any Mk2 or Mk3 seed made using versions between 4.0.0 and 4.1.9 is considered a “confirmed vulnerable path,” according to The Block, because the device did not reseed its source of randomness securely. Coinkite extends this warning until firmware version 5.0.3, which is the last version of firmware that supports the Mk3.

For newer devices, the picture is less clear. The Block says the Mk4, Q, and Mk5 use entropy from a secure element but retain only four bytes of it, limiting the number of possible seed-generation paths. Coinkite says its Tapsigner, Opendime, and Satscard products use different codebases and are unaffected.

A $38 million sweep in 25 minutes

The incident that attracted the attention of the public due to the security malfunction happened quickly.

Roughly 500 wallets holding more than 0.15 BTC each had been drained on Friday between 01:31 and 01:56 UTC, many of which had been inactive for several years, with coins going back to the years between 2021 and 2026. Rob Hamilton, CEO of AnchorWatch, stated that he tracked a total of 1,324 spent outputs in 500 transactions which took place across three blocks, with 562 BTC later consolidated into a single address.

The figure might be greater. Block engineer Clay Garrett found an additional 695 transactions that had the same signature as the verified thefts. The transactions supposedly moved 488.1 BTC altogether. Thus, if everything is linked, the total amount could be around 1,082 BTC. Coinkite has not yet verified whether or not the wallet drainage happened because of the fault in the firmware.

How predictable randomness broke the seeds

The Block found the source of the issue in the firmware configuration that turned off the Mk3’s hardware random number generator. A library used alongside the firmware only checked if the configuration was present, but not if it was enabled or disabled, leading to the key generation reverting to a software method, which in this case relied on known public values such as the serial number and the clock registers of the device.

The problem was traced by the company back to a code commit that was dated March 1, 2021, which was included for the first time in version 4.0.0 of the firmware. The company stated that it came forward with its disclosure before it completed its testing because “active exploitation is underway.”

What Coinkite tells owners to do

The recommendations from Coinkite rely on how the wallet was set up.

According to Coinkite’s preliminary assessment, users who have taken the precaution of using a separate BIP-39 passphrase along with a PIN have very little chance of losing their funds, unless they entered the passphrase into a smartphone, computer, or website.

Everyone else is advised to move their funds. Coinkite suggests that users create a new seed on an uninfected device, check to ensure that backup and receive addresses are correct, send a small transaction, and only then move part of the remaining balance.

In addition, the organization describes a sophisticated dice-roll method that eliminates the random number generator of the gadget, while at the same time, warns users against the hurry to move, as there are chances that mistakes in the recovery might trigger more damage than the vulnerability being discussed.

Is there hope of recovering stolen Bitcoins?

That’s a question that has only one sad answer: No. In hindsight, let’s do this: Know your wallet like you built it. The “best wallet” reviews come from independent security research, academic work, audits, and technical documentation from the vendors themselves.

Figure 1. Vendors Documentation

The strongest comparisons come from reading each vendor’s technical documentation side by side. Instead of ranking wallets as “best,” compare objective characteristics. That shifts the focus from subjective rankings to verifiable factors such as independent audits, reproducible firmware, certification, disclosure practices, and response to vulnerabilities—criteria that are especially relevant in the wake of the Coldcard Mk3 incident.

The smartest crypto minds already read our newsletter. Want in? Join them.