Coinkite Warns Coldcard Mk3 Users as Experts Examine $38M Bitcoin Drain

Key Point

Coinkite warned Coldcard Mk3 users to move funds from wallets whose seed phrases were generated on affected firmware. Coinkite said affected firmware runs from version 4.0.1, released in March 2021, through version 5.0.3, while Mk4, Q and Mk5 are not affected. The warning came as specialists examined an unexplained sweep of 594.48 BTC, worth approximately $38.3 million according to CoinGecko, from single-signature addresses, but no definitive public evidence has linked the Mk3 issue to the transfers. AnchorWatch CEO and co-founder Rob Hamilton said 1,324 UTXOs were swept across 500 transactions within a three-block window. Wizardsardine CEO Kevin Loaec said his low-entropy random-number generator hypothesis remains unconfirmed and warned that partially drained wallets may remain at risk.

Why it matters: Weak seed generation could turn a wallet setup problem into direct private-key exposure for affected self-custody users.

Market Sentiment

Cautiously Bearish, Stress-on, Event-driven, De-risking.

Reason: Coinkite warned affected Coldcard Mk3 users to move funds, which may reduce confidence in vulnerable self-custody setups.

Similar Past Cases

In September 2022, Ethereum addresses generated with Profanity were drained after weak key generation made private keys calculable, and The Block reported that $3.3 million was stolen from several addresses. (The Block) Difference: Profanity involved Ethereum vanity addresses, while the current case involves Bitcoin single-signature addresses and an unconfirmed link to Coldcard Mk3 firmware.

Ripple Effect

Weak seed generation would transmit through private-key exposure before users see normal market signals. If more drained wallets share the same generation path, then the incident could push users toward wallet migration and stricter seed-generation checks. If the technical review narrows the affected setup, then broader self-custody confidence may remain contained.

Opportunities & Risks

Opportunities: When Coinkite publishes its formal technical review, then users can treat confirmed unaffected setup paths as a safer self-custody signal.

Risks: If more single-signature wallets show coordinated unauthorized sweeps, then reducing exposure to affected seeds limits further theft risk during migration.