A new Coldcard Mk3 security warning has put a narrow but important group of Bitcoin self-custody users on alert. Coinkite says seeds generated on Coldcard Mk3 devices while running firmware versions from 4.0.1 through 5.0.3 may be exposed to a weakness and should be treated cautiously. The company is urging affected owners who did not add a BIP39 passphrase to create a new seed on an unaffected device and move their bitcoin.
The notice emerged alongside reports that roughly 594 BTC moved from about 500 long-dormant addresses during a concentrated 25-minute window. Early estimates valued the transferred bitcoin near $38 million at the time. Coinkite has not confirmed that its advisory and the sweep are connected, so the two developments should not be presented as one proven incident.
That distinction matters. A security response can be urgent without assigning a cause that investigators have not established. For users, the practical question is whether their own wallet setup falls inside the affected conditions and what a careful migration requires.
What the Coldcard Mk3 Security Warning Covers
The warning applies to seeds created directly on a Coldcard Mk3 while the device was running firmware from version 4.0.1 through 5.0.3. It does not broadly declare every Coldcard compromised, nor does it say that every wallet produced by those versions will lose funds.
Coinkite’s early assessment excludes the newer Mk4, Q and Mk5 models. It also says the relevant risk is minimal for wallets protected with an additional BIP39 passphrase, because that passphrase changes the wallet derived from the seed words. Users should still verify their exact configuration rather than relying on memory or assuming that a PIN is the same as a passphrase.
A device PIN protects access to the hardware. A BIP39 passphrase becomes part of the cryptographic input used to derive addresses. Confusing those two controls could lead someone to believe a wallet has protection that it does not actually have.
Why seed generation is the critical layer
A hardware wallet’s main job is to create and protect private keys while keeping signing operations away from an internet-connected computer. The seed phrase is the human-readable backup from which those keys are derived. If the process that creates a seed does not provide the expected unpredictability, the security problem exists before the user receives coins.
That is different from a phishing attack that tricks a holder into revealing words or approving a malicious transaction. It is also different from malware attempting to alter a destination address on a laptop. In a seed-generation issue, the concern is whether the underlying secret started with enough uncertainty.
Users cannot repair an at-risk seed by installing newer firmware. An update can correct future behavior, but it cannot retroactively change a wallet’s existing secret. The remedy is to generate an independent new seed under safe conditions and transfer funds to addresses derived from it.
The 594 BTC Sweep Remains a Separate Investigation
Blockchain observers identified a rapid series of transfers affecting hundreds of addresses that had been inactive for years. The timing and similarity of the movements prompted speculation about a common security failure. Those patterns justify investigation, but they do not prove which wallet model, firmware version or seed process was involved.
Bitcoin’s public ledger can show when coins moved, which addresses were involved and how transactions relate onchain. It does not reveal by itself whether the owner initiated a migration, an attacker obtained keys, or several custodial arrangements shared a common operational process.
The responsible conclusion is therefore limited: a large coordinated-looking sweep occurred, and a manufacturer separately issued a warning covering a defined set of Mk3 seed-generation conditions. A causal link remains unconfirmed.
Why careful language protects users
Overstating an unproven connection can create two kinds of harm. It can cause panic among people whose devices are not affected, and it can encourage hurried transfers by owners who have not prepared a safe destination. Security incidents are precisely when users are most vulnerable to fake support accounts, malicious firmware links and lookalike websites.
The safest starting point is the manufacturer’s official advisory reached through a known domain. Owners should avoid entering seed words into a website, chat, support ticket or general-purpose computer. No legitimate migration process requires sharing the phrase with a stranger.
A Safer Migration Process
Affected users have been advised to create a new seed on an unaffected hardware wallet or to use the device’s dice-roll import process, which lets physical randomness contribute directly to seed creation. The destination wallet should be backed up before funds move.
The recommended sequence emphasizes verification. First, identify the model and the firmware that was active when the seed was originally generated. Second, establish a new wallet whose seed is independent of the old one. Third, confirm the new receive address on the trusted device rather than only on a connected screen.
A small test transaction can confirm that the destination is correct and that the new backup restores the expected wallet. Only after that test is confirmed should the remaining balance be moved. The old backup should be preserved until the transfer and recovery checks are complete, then handled according to a secure retirement procedure.
Users should also review any accounts derived from the same seed. One backup can underpin multiple address types or wallets, so moving only a visible balance may leave other funds exposed. Multisignature setups require separate analysis because one possibly affected key does not necessarily control the wallet alone, yet replacing that key can still be prudent.
What Comes Next for Hardware Wallet Security
The episode is likely to focus attention on reproducible builds, entropy testing, disclosure practices and the ability of users to verify how a device creates secrets. Hardware wallets reduce many online threats, but they do not eliminate supply-chain, firmware or operational risk.
For manufacturers, a useful response includes a precise affected range, clear migration guidance and continuing technical analysis. For users, the lesson is not to abandon self-custody. It is to understand which controls protect a seed, keep backups offline and maintain a practiced recovery plan before an urgent warning arrives.
Investigators may eventually determine whether the 594 BTC sweep is connected to the affected seed-generation process. Until then, the Coldcard Mk3 security warning should be treated on its own verified terms: users inside the stated scope should follow official instructions methodically, while everyone else should resist speculation and remain alert for impersonation attempts.
