Coldcard Mk3 Wallet Flaw Leads to 594 BTC Drain

A significant security breach has occurred in the cryptocurrency markets. A randomness flaw identified in Coldcard Mk3 models, produced by the popular hardware wallet manufacturer Coinkite, led to the theft of approximately 594 Bitcoin (BTC), worth around $38 million. The attack took place within a short 25-minute window on Friday, resulting in funds being drained from approximately 500 wallets. This incident underscores that even hardware wallets are not infallible and highlights the critical importance of seed phrase security once again.

Details of the attack emerged from an investigation by Block's Bitcoin engineering and security teams. A bug in Coldcard's key generation process made seed phrases, which are normally meant to be impossible to guess, more easily predictable. A build setting caused the device to skip its own hardware randomness generator, falling back to a basic software substitute seeded from non-secret data such as the chip's serial number and clock registers. This flaw affected Mk3 firmware versions 4.0.0 and later, released in March 2021. Coinkite warned users who generated a seed on Coldcard Mk3 devices running firmware versions from 4.0.1 to 5.0.3.

Most of the drained wallets were single-signature and held more than 0.15 BTC. Many had been dormant for years, and the stolen Bitcoin spanned from 2021 to 2026, almost perfectly matching the age of the flaw. Rob Hamilton, CEO of AnchorWatch, noted that the attacker swept 1,324 unspent transaction outputs (UTXOs) across 500 transactions within a three-block window, with 562 BTC then consolidated into a single address. Coinkite, the manufacturer of Coldcard, stated that Mk4, Q, and Mk5 models are not affected by this issue and emphasized that seed phrases used with a BIP-39 passphrase carry a lower risk.

This event has profoundly impacted the perception of security in the cryptocurrency markets. Hardware wallets, often considered one of the most secure storage methods due to their offline nature, have been shaken by the emergence of such a vulnerability. While there wasn't a major fluctuation in Bitcoin's (BTCUSD) value, investor concerns regarding hardware wallet selection and seed phrase management have escalated. The targeting of long-inactive wallets holding significant amounts of assets serves as a crucial warning about the potential risks associated with older device and software versions.

This development can also be seen as a reflection of broader security vulnerabilities within the crypto ecosystem. Similar weak randomness incidents, such as Milk Sad and the Trust Wallet browser extension flaw, have occurred in the past. The record levels of crypto thefts in the first half of 2026 indicate that cyber attackers are continuously developing new methods and that wallet security remains the biggest weakness in the industry. The increasing use of AI-powered attacks and social engineering tactics further necessitates greater user vigilance.

Analysts and security experts advise Coldcard Mk3 users to immediately generate a new seed phrase and securely transfer their assets to a new wallet. This situation once again highlights the importance of stricter security audits and transparent bug reporting processes for hardware wallet manufacturers. In the future, independent audits of hardware wallet randomness generators and regular monitoring of software updates by users will be critical steps to prevent similar attacks. The security of crypto assets will continue to be an evolving battleground alongside technological advancements.