Coinkite warns: key development in Bitcoin security!

Bitcoin hardware wallet maker Coinkite has issued an important security warning for Coldcard Mk3 users. The company said wallets generated using devices with specific firmware versions could be risky. The warning was issued after approximately 594 bitcoins on the blockchain were transferred to different addresses within a short period of time. These bitcoins are currently worth approximately US$38 million, and the incident has attracted widespread attention in the cryptocurrency community.

About 594 bitcoins were transferred in 25 minutes

On July 30, 2026, in about 25 minutes, a total of 594 bitcoins were transferred among approximately 500 single-signed bitcoin addresses that had not been moved for a long time. It is worth noting that most of these wallets have not traded for many years, and the balance is usually between 0.15 and 0.26 bitcoins. As of now, Coinkite has not confirmed that these transfers are directly related to Coldcard Mk3 security warnings. But due to a coincidence in time, the two things were discussed together, and community researchers are continuing to analyze the dynamics of the chain.

Coinkite CEO Rodolfo Novak (NVK) said the company is investigating the matter with the highest priority. Novak posted on social media platform X that the entire team is analyzing the technical aspects of the incident in detail and will release a comprehensive technical report in the near future. He also said the company's support channels had received a large number of questions related to the incident.

According to Coinkite's preliminary investigation, the security risk only involves specific Coldcard Mk3 devices. Devices that may be affected include: Coldcard Mk3 models; seeds generated between firmware versions 4.0.1 and 5.0.3; and specific wallets created after March 2021. Preliminary investigation revealed that the models not affected are: Coldcard Mk4, Coldcard Q, and Coldcard Mk5. The company said the investigation is still in progress and a more comprehensive report will be released after the final technical analysis is completed.

Where could the problem originate?

Community researchers believe that this incident may not be a supply chain attack, but rather may be related to possible weaknesses in the random number generation process in some firmware versions of older Mk2 and Mk3 devices. However, Coinkite stressed that the exact cause of the vulnerability has not been confirmed so far and all possibilities are under investigation. According to the company's statement, the risk level to users using the BIP-39 password is considered to be quite low. Coinkite recommends that users who use passwords: keep the confidentiality of their BIP-39 passwords; do not type them on untrusted devices; and do not use them on suspicious websites.

Recommendations for Mk3 users

Coldcard Mk3 users who do not use a password are advised to generate a new seed and transfer funds to a secure wallet. The company's recommendations are as follows: Make a small test transfer first; verify the new wallet address on the device screen; keep old backups until all operations are completed; and fully transfer funds only after all verifications are complete.

Coinkite's suggested temporary solution

Coinkite proposes two temporary solutions only for users with Mk3 devices: adding a strong and unique BIP-39 password to transfer funds to this newly protected wallet; and generating new seeds using a dice roll method that does not rely on a device random number generator. The company emphasizes that the second method is suitable for advanced users and needs to be implemented carefully.

Security warnings issued by Coinkite make it necessary for Coldcard Mk3 users to check their devices and the firmware versions they are using. While it has not been confirmed whether Bitcoin transfers worth about $38 million are related to this vulnerability, the findings will be closely watched by the hardware wallet security community.