Coinkite Warns Coldcard Mk3 Owners After Reports of $38M Bitcoin Loss
Coinkite issued a security advisory Thursday warning owners of its Coldcard Mk3 hardware wallet that funds tied to certain firmware versions may be at risk. The warning follows reports of an alleged 594 BTC, worth about $38 million, moving from approximately 500 single-signature addresses within roughly 25 minutes on July 30, 2026. Many of the wallets had remained inactive for years, with balances typically ranging from 0.15 to 0.26 BTC. At the time of writing, Coinkite has not confirmed whether the transfer is directly connected to the security advisory.
Coinkite CEO Rodolfo Novak, known as NVK, said the company is treating the reports with urgency. “We are all hands on deck doing a deep dive on everything, technical post soon,” he said on X. He added that communication channels were “bombarded” with inquiries. The company’s advisory specifies that anyone who generated a seed on a Mk3 running firmware version 4.0.1 (March 2021) through version 5.0.3 (the final Mk3 release) may be affected. Coinkite’s early analysis shows that Mk4, Q, and Mk5 models are not affected.
Community researchers have been reviewing onchain activity, discussing the possibility of weak randomness in seed generation on certain older Mk2 and Mk3 firmware versions, rather than a supply chain compromise. The root cause has not yet been confirmed.
According to the advisory, wallets protected with a BIP-39 passphrase appear to carry minimal risk. Coinkite advised passphrase users to keep protecting that phrase and avoid entering it on untrusted devices or websites. For Mk3 owners who did not use a passphrase, Coinkite recommended migrating to a new seed generated on an unaffected device. The company advised sending a small test transaction first, verifying the new wallet and receive address on the device screen, and holding onto the old backup until the migration is confirmed.
For owners whose Mk3 is their only device, Coinkite outlined two interim steps: add a strong, unique BIP-39 passphrase and move funds to the newly protected wallet, or generate a replacement seed using the Mk3’s dice-roll import path, which does not rely on the device’s random number generator. Coinkite described the latter as an advanced procedure requiring careful verification. The company’s investigation is ongoing, and additional details will follow.