Coinkite Warns Coldcard Mk3 Users After 594 BTC Theft Reports

Key Point

Coinkite published a security advisory on Thursday warning that users who generated a seed on a Coldcard Mk3 may have funds at risk. Coinkite said the issue affects Mk3 seeds generated on version 4.0.1 or any subsequent version through firmware version 5.0.3. Coinkite said Mk4, Q and Mk5 are not affected based on early analysis, and users who applied a BIP-39 passphrase to an affected Mk3 seed face limited exposure. Atlas 21 reported that approximately 594.5 BTC, worth $38.3 million, was swept from 500 single-signature addresses in Bitcoin blocks 960188 to 960191. Coinkite has not confirmed a link between the theft and the security issue.

Why it matters: Wallet seed risk can directly affect self-custody security because compromised key generation may expose funds without exchange or protocol failure.

Market Sentiment

Bearish, Stress-on, Event-driven, De-risking.

Reason: Coinkite warned that funds generated from affected Coldcard Mk3 seeds may be at risk, which supports a defensive market read for self-custody users.

Similar Past Cases

In August 2022, Solana wallet users lost about $4.5 million in SOL and other tokens after a private key exploit was tied to Slope mobile wallet, and the incident affected about 8,000 unique wallets. (Decrypt) The difference is that the Slope case involved a mobile software wallet, while the current Coinkite issue involves a hardware wallet seed advisory with the exact cause still unconfirmed.

Ripple Effect

Seed-generation risk can spread through self-custody confidence because users rely on device randomness to protect long-term holdings. If Coinkite confirms a broader affected firmware scope, then hardware wallet users may reassess seed generation and migration practices. If no further drains appear after users migrate, then spillover may stay limited to affected Mk3 seeds.

Opportunities & Risks

Opportunities: When Coinkite publishes more details, then affected Mk3 users can use the confirmed scope as a wallet-migration priority signal. A confirmed narrow scope would help limit unnecessary wallet changes.

Risks: If more transactions are linked to the same issue, then delaying migration becomes a stronger custody-risk signal for wallets matching the affected setup. Rushed migration can also create immediate operational risk, according to Coinkite.