Scope

Core

random

Bitcoin

<p><span style="font-family: var(--global--font-secondary); font-size: var(--global--font-size-base);">Coinkite has warned every user who generated a seed on a Coldcard Mk3 running firmware 4.0.1 through 5.0.3 to treat the wallet as potentially exposed and migrate its bitcoin. The </span><a style="font-family: var(--global--font-secondary); font-size: var(--global--font-size-base);" href="https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/" rel="noopener noreferrer nofollow">security advisory</a><span style="font-family: var(--global--font-secondary); font-size: var(--global--font-size-base);"> followed research by Block’s Bitcoin engineering and security teams, which identified weak seed-generation behavior while investigating remotely drained wallets.</span></p><p>Coinkite’s immediate warning covers Mk3 firmware released from March 2021 onward. The company’s early analysis says Mk4, Q and Mk5 devices are not affected by the issue behind its advisory, while Block researchers described two weaknesses reaching <a href="https://cryptoadventure.com/best-hardware-wallets-to-use-in-2026-secure-cold-storage-without-the-confusion/" rel="noopener noreferrer nofollow">Coldcard</a> generations at different severity levels. Block said no Bitkey or other Block products are affected.</p><h2 id="developers-reproduce-predictable-mk3-seed-generation">Developers Reproduce Predictable Mk3 Seed Generation</h2><p>Bitcoin Core developer Gregory Sanders, known as instagibbs, <a href="https://x.com/theinstagibbs/status/2082958675975553224" rel="noopener noreferrer nofollow">reproduced the Mk3 weakness</a> on a freshly initialized device using only the number of keypad presses made during setup. He said Mk2 and Mk3 users should treat the exposure as urgent, while the Mk4’s status had not been confirmed through his test.</p><p>Developer Antoine Poinsot identified a hardware difference in the newer model: Mk4 seed generation uses the microcontroller’s true random number generator, while Mk3 firmware did not use that source in the same way. Coinkite’s <a href="https://blog.coinkite.com/version-4.0.0-released/" rel="noopener noreferrer nofollow">March 2021 release notes</a> show version 4.0.0 replaced all cryptographic and BIP-39 code with new equivalents. Foundation Devices CEO Zach Herbert traced the apparent entropy defect to the <a href="https://x.com/zherbert/status/2082993276324319713" rel="noopener noreferrer nofollow">same 120-file rewrite</a>, while stressing that no evidence ties the error itself to the licensing change.</p><h2 id="block-traces-potential-drain-scope-to-1-083-btc">Block Traces Potential Drain Scope To 1,083 BTC</h2><p>The first identified sweep moved 594.48 BTC from 500 single-signature addresses across Bitcoin blocks 960188 to 960191. <a href="https://atlas21.com/594-bitcoin-drained-15-minutes-theft/" rel="noopener noreferrer nofollow">Atlas21 counted 1,324 spent UTXOs</a> and found that 562 BTC was consolidated into another address before the sequence ended.</p><p>Block engineer Clay Garrett later <a href="https://x.com/clay_garrett/status/2082980439367487724" rel="noopener noreferrer nofollow">flagged 695 earlier transactions</a> carrying the same full fingerprint as the known set. Those transfers moved another 488.10957948 BTC, lifting the potential combined scope to 1,082.58680432 BTC if both groups belong to the same operation. The total was worth about $69.6 million with bitcoin trading near $64,247.</p><p>Coinkite has not established that the firmware weakness caused every transaction in either set. Block’s team said the attack was likely ongoing, and the broader transaction group remains under verification.</p><h2 id="affected-seeds-must-be-replaced-not-reimported">Affected Seeds Must Be Replaced, Not Reimported</h2><p>Moving an affected recovery phrase into another hardware or software wallet does not repair it because the underlying seed remains predictable. The defect concerns seed creation, unlike <a href="https://cryptoadventure.com/sparkkitty-malware-in-app-stores-scanned-photos-for-crypto-seed-phrases/" rel="noopener noreferrer nofollow">SparkKitty malware searching phone images for recovery phrases</a> or <a href="https://cryptoadventure.com/north-korea-linked-bluenoroff-uses-fake-zoom-calls-to-profile-crypto-wallets/" rel="noopener noreferrer nofollow">BlueNoroff campaigns profiling wallets through fake meeting calls</a>.</p><p>Coinkite recommends generating a fresh seed on an unaffected device, recording and verifying the backup, checking a receive address, sending a small test transaction and only then moving the remaining balance. Users unable to migrate immediately can create a strong, unique <a href="https://cryptoadventure.com/everything-you-need-to-know-about-mnemonic-passphrase/" rel="noopener noreferrer nofollow">BIP-39 passphrase</a> as an interim measure. Advanced users may generate a dice-only seed on an empty Mk3 running firmware 4.1.9 with at least 99 independent rolls.</p><p>The post <a href="https://cryptoadventure.com/coinkite-warns-coldcard-mk3-users-as-block-traces-up-to-1083-btc-in-drains/" rel="noopener noreferrer nofollow">Coinkite Warns Coldcard Mk3 Users As Block Traces Up To 1,083 BTC In Drains</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.</p>

Coinkite Warns Coldcard Mk3 Users As Block Traces Up To 1,083 BTC In Drains

Table of Contents

Crypto Adventure

Other articles published on Jul 31, 2026

Here’s Why Uniswap’s UNI Price Is Suddenly Back on Traders’ Radar

Wintermute Warns Crypto’s Next Altseason Could Be Less Lucrative

Coldcard Advisory Ties 594 BTC Theft to a Flaw Found Only in Mk3

BlackRock's BUIDL lands on Stripe's payments chain

Polygon Set for Potential Upswing in Crypto Markets

Morgan Stanley's new Solana ETF is already carrying the whole field

Join our free newsletter for daily crypto updates!