Coldcard Mk3 seed-generation flaw: move BTC now amid 594 BTC theft probe
Coinkite warns of a Coldcard Mk3 seed-generation flaw linked to weak randomness during seed creation. Coldcard seed phrases generated on affected firmware builds may have only ~72 bits of entropy instead of the expected 128 bits, creating a theoretical predictability risk for some users.
The company urges immediate trader-grade action: move all BTC off any affected Coldcard Mk3, then create and migrate to a new wallet using a fixed firmware (Mk4/Mk5 to 5.6.0+) or a different hardware wallet. Users should verify the new balance is zero on the old device, back up and confirm the new seed/address, and wipe the impacted device. Q devices below 1.5.0Q are also affected, though with a less severe impact.
This advisory comes as an investigation follows reports of ~594 BTC drained from hundreds of single-signature wallets. Coinkite did not confirm a direct link to the theft, but the timing raises the possibility of overlap.
For traders, this is not a protocol-level attack on Bitcoin, but a targeted self-custody operational-risk event. If more details confirm broader misuse or additional models are implicated, near-term sentiment around BTC custody and hardware-wallet trust could turn risk-off.
Neutral
Coinkite’s warning targets Coldcard seed-generation flaw on specific hardware/firmware combinations and focuses on user migration steps. It is not a Bitcoin protocol compromise, so long-term BTC fundamentals are unchanged. However, the advisory lands alongside reports of ~594 BTC drained from hundreds of single-signature wallets, which can still trigger short-term risk-off sentiment about self-custody and hardware-wallet trust. Because the exploit link is unconfirmed and the threat appears operational/targeted, the expected direct price impact on BTC is limited, making the overall market effect closer to neutral unless further evidence expands the affected scope.