Coldcard Users Warned as $38M BTC Sweep Raises Seed Generation Concerns

Coinkite, the maker of hardware wallet Coldcard, has issued an urgent security warning for owners of its Coldcard Mk3 signing device. The company advises users to move funds away from wallets whose seed phrases were generated using specific affected firmware versions. This risk applies to Mk3 firmware 4.0.1 (released in March 2021) through 5.0.3, the last firmware version that supports the Mk3.

The warning comes as security researchers investigate an unexplained sweep of 594.48 BTC from single-signature addresses, valued at approximately $38.3 million using a Bitcoin price of $64,364.07. Coinkite emphasizes that there is no definitive public proof linking the Mk3 seed-generation issue to this activity.

The company's early analysis did not identify the same concern for Coldcard Mk4, Q, or Mk5 devices. Coinkite recommends generating a new seed on an unaffected device, verifying backups and receive addresses, and testing with a small transaction first.