Coinkite Flags Coldcard Seed Bug After $70M BTC Theft

Key Point

Coinkite said Coldcard users should take precautions after a $70 million BTC hack affected wallets tied to weak seed generation. Data from Galaxy Research and engineers at Block shows 1,082.65 BTC has disappeared from wallets. Hackers first drained funds from 1,196 Bitcoin addresses on Thursday because private keys were not generated with sufficient entropy. A firmware bug in Coldcard Mk3 devices starting with version 4.0.1 in March 2021 caused seed generation to fall back to a weak software PRNG instead of the hardware true random number generator. Coinkite has not admitted that the hack is linked to Coldcard wallets, but the company said Mk3 users were affected and later told Mk4, Mk5, and Q users to take precautions.

Why it matters: A wallet seed-generation failure could turn self-custody into direct theft risk when private keys become predictable.

Market Sentiment

Bearish, Stress-on, Tech-driven, De-risking.

Reason: The reported $70 million drain from wallets with weak seed generation may weaken confidence in hardware wallet security.

Similar Past Cases

In September 2022, Wintermute lost about $160 million after an attacker exploited a Profanity-related private key weakness, and CEO Evgeny Gaevoy said the firm would continue on-chain trading. (The Block). The key difference is that Wintermute was a professional market maker, while the Coldcard incident appears centered on end-user wallet seed generation.

Ripple Effect

Weak seed generation can spread from direct theft risk into broader custody caution because users may rush to move funds from affected devices. If Coinkite publishes clearer firmware guidance and drains stop, then confidence may stabilize. If drains continue, then hardware wallet users may treat the issue as an active security risk rather than a resolved bug.

Opportunities & Risks

Opportunities: If Coinkite guidance confirms a safe seed-regeneration process, then completed migration can reduce cold-storage operational risk. If affected users move funds without further drains, then custody confidence may recover faster.

Risks: If drains continue after guidance, then reducing balances on affected Coldcard-generated wallets limits theft risk. If users delay seed replacement, then predictable private keys may remain exposed.