Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC Canadian Bitcoin hardware maker Coinkite warns Coldcard Mk3 users to transfer funds
Canadian Bitcoin hardware maker Coinkite has issued a warning to users of its Coldcard Mk3 signature device advising them to transfer funds through wallets corresponding to seed phrases generated by affected firmware. The company said on Thursday that seeds generated on devices running firmware version 4.0.1 released in March 2021 or any subsequent Mk3 versions may pose a financial risk. According to Coinkite's preliminary analysis, the impact of this issue covers firmware version 5.0.3 ultimately supported by Mk3, while Mk4, Q and Mk5 models are not affected.
This warning comes as Bitcoin security experts are investigating an unexplained collaborative coin sweep involving the transfer of 594.48 BTC from a single-signature address. However, there is currently no conclusive public evidence that the Mk3 problem caused these transfers.
Coinkite said it "out of caution" and advised affected users to generate new seeds on unaffected devices, verify their backup and collection addresses, send a small test transaction first, and then transfer the remaining funds. The company said the investigation was still ongoing and promised to release a formal technical review report.
Coinkite also pointed out that its preliminary analysis showed that affected seeds using the BIP-39 passphrase were at lower risk, emphasizing that this referred to the passphrase, not Coldcard's PIN code.
Experts analyze the 594 BTC sweep event
The coin sweep incident attracted attention because a Reddit user said that funds in his wallet had been emptied, and the wallet's seeds were generated on the Coldcard Mk3 purchased in May 2021. The user stated that the seed was later restored to a Coldcard Mk4 device in January 2026, which meant that the seed had been entered into another device again. This statement is a unilateral report and does not prove that there is a connection between Coldcard and the large-scale currency sweep.
AnchorWatch CEO and co-founder Rob Hamilton pointed out in a preliminary analysis released on Friday that a total of 1,324 unspent transaction outputs were swept through 500 transactions involving 594.48 BTC over the three-block window. Based on CoinGecko data, these bitcoins are worth approximately US$38.3 million based on the bitcoin price of US$64,364.07 at the time of writing. Hamilton said all the addresses involved were single-signature addresses, with 562 BTC subsequently merged into another address. "At first glance, this seems to indicate an entropy flaw in the wallet generation process," he wrote.
At the same time, Wizardsardine CEO Kevin Loaec said his current assumption is that a low-entropy random number generator (which may exist in a software library, secure element, specific device batches or firmware versions) generated wallet seeds that were not sufficiently random. He speculated that attackers who knew about the vulnerability might have used AI-generated scripts to brute-force attacks on affected wallets, but only searched for a limited range of BIP-84 derivative paths. This may explain why currency sweep events are concentrated on native SegWit addresses and why some wallets are only partially emptied. However, Loaec emphasized that the theory has not yet been confirmed.
Loaec warned that if his assumptions are correct, wallets that have only been partially emptied may still be at risk of further theft. He added that funds in other address types could also be at risk if attackers expand the scan to cover other address types.
