Coinkite advises migrating funds from Coldcard Mk3 devices due to a potential seed-generation flaw amid a separate $38M BTC drain investigation.
Canadian hardware wallet maker Coinkite urged Coldcard Mk3 users to move funds after identifying a potential vulnerability in seed generation. The issue affects devices running firmware versions 4.0.1 through 5.0.3, released between March 2021 and the final Mk3 update.
The warning coincides with an ongoing probe into an unexplained $38 million Bitcoin drain involving 594.48 BTC from single-signature addresses. No evidence links the Mk3 flaw to the transfers, but Coinkite advised caution, recommending users generate new seeds on unaffected devices and verify backups.
Coinkite noted that seeds used with a BIP-39 passphrase face minimal risk, distinguishing this from the device’s PIN. The company is conducting a formal technical review and confirmed Mk4, Q, and Mk5 models remain unaffected.