Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC Bitcoin hardware wallet manufacturer Coinkite discloses a major security vulnerability and advises users to immediately transfer assets.
Bitcoin hardware wallet manufacturer Coinkite announced the discovery of a serious security vulnerability that may affect the security of seed phrases generated by some Coldcard Mk3 devices. The company recommends that users at risk immediately transfer funds to new secure wallets.
According to Coinkite, the problem originated from the seed generation process for Coldcard Mk3 devices running firmware versions 4.0.1 to 5.0.3. Users who have previously generated seeds on these devices should consider all associated Bitcoin addresses as potentially risky.
Mass theft investigation still underway
The warning comes as an investigation into a massive bitcoin theft continues. In this incident, hundreds of single-signature Bitcoin wallets were stolen with a large amount of BTC. Although preliminary reports showed that the amount stolen was approximately 594 BTC, Galaxy Research's in-depth analysis pointed out that a total of 1196 wallets were completely emptied, with a total loss of 1,082.65 BTC. Based on the transaction price at the time, the stolen assets were worth approximately US$70.2 million.
According to Galaxy Research, these wallets were emptied in just 41 minutes on July 30. All transactions use the same 30 sat/vB fee and no change address is generated, indicating that the transfer is not manually performed by the user, but is performed by an automated tool after scanning the stolen private key.
According to reports, the stolen bitcoins were eventually consolidated into four different addresses, and so far no transaction activity has occurred at these addresses. It is worth noting that the attack occurred about 30 hours before Coinkite publicly disclosed the Coldcard Mk3 vulnerability.
Security experts give urgent advice
Security experts advise that users who have created seeds on Coldcard Mk3 devices should no longer regard old seed phrases as safe. Users should create new seeds using a reliable and updated hardware wallet with the latest version and transfer all funds to the new address. Simply replacing the device is not enough, and old seed phrases should not be imported into a new wallet.
