Coldcard Mk3 Users Warned of Risk After Mass Bitcoin Drain
A security warning has been issued to Coldcard Mk3 users after an automated operation drained Bitcoin funds from 500 affected addresses. The issue stems from weak private keys generated when wallets were created on certain firmware versions.
The affected seeds have around 72 bits of entropy instead of the expected 128 bits, according to Coinkite, the company behind the Coldcard hardware wallet.
Users with affected devices are urged to migrate their funds to a newly generated seed on an unaffected device. For Mk4 and Mk5 users, this involves upgrading to firmware version 5.6.0 or later before generating a replacement seed.
The warning comes after reports emerged of a large-scale theft, in which 594 BTC (worth around $38 million at current prices) was swept from single-signature addresses across four consecutive blocks.