Coldcard Warns Users About Potential Seed Phrase Risk Amid $38.3M BTC Transfer Probe

Coldcard, a hardware wallet manufacturer, has issued a security warning regarding its Mk3 device. Users who generated seed phrases using firmware versions 4.1 to 5.3 are advised to migrate their assets as soon as possible.

The company states that initial analysis suggests wallets created with BIP-39 passphrases have lower risks, while devices such as the Mk4, Q, and Mk5 remain unaffected.

Meanwhile, security researchers are investigating an unusual transfer of 594.48 BTC (approximately $64,220) worth around $38.3 million USD. AnchorWatch CEO Rob Hamilton suspects that a lack of randomness in the wallet generation process may be to blame, while Wizardsardine CEO Kevin Loaec speculates that the issue could stem from low-entropy random number generators in software libraries or security chips.

While no conclusive evidence links this transfer to the Coldcard Mk3 vulnerability, researchers are still investigating. Hamilton noted that attackers used 500 transactions over three blocks to move 1324 UTXOs.