Coinkite Warns Coldcard Mk3 Users Amid $38M Bitcoin Sweep Investigation

Coldcard, a Canadian Bitcoin hardware maker, has issued a warning to users of its Coldcard Mk3 signing device regarding potential fund safety. The company, Coinkite, announced on Thursday that seeds created on an Mk3 running firmware version 4.0.1 or later may put funds at risk.

The issue extends through version 5.0.3, the final firmware supporting the Mk3, while the Mk4, Q and Mk5 are not affected. Coinkite's early analysis indicates that affected seeds used with a BIP-39 passphrase face minimal risk, stressing that this refers to a passphrase rather than the Coldcard PIN.

Experts are examining an unexplained, coordinated sweep involving 594.48 BTC from single-signature addresses. However, no definitive public evidence has established that the Mk3 issue caused those transfers.