Coldcard Mk3 Devices May Be Vulnerable to Theft Due to Seed Phrase Generation Issues

Coinkite has issued a security warning related to Coldcard Mk3 devices running firmware version 4.0.1 or later, which was released in March 2021. The affected versions extend through 5.0.3, the final supported release for the Mk3. This warning does not apply to other models such as the Mk4, Q, or Mk5.

The alert comes as security researchers investigate an unexplained transfer of 594.48 Bitcoin from a single-signature address worth approximately $38.3 million based on CoinGecko prices. While there is no evidence that the transfer was caused by a Coldcard flaw, users who generated seeds on affected devices are advised to take precautions.

Coinkite recommends generating a new seed on an unaffected device as a precautionary measure. Users should also verify backups and receiving addresses, send a small test transaction first, and then move their remaining funds. The investigation is ongoing, and the company plans to release the results of an official technical review later.