Coinkite issued an urgent warning to Coldcard Mk3 hardware wallet users, directing them to migrate funds immediately over a potential seed-generation vulnerability. The company identified a risk in how the wallet generates private keys, prompting the precautionary measure.
The timing compounds concerns in the Bitcoin custody space. Separately, security researchers are investigating an unexplained $38 million drain from a Bitcoin wallet, examining whether the loss stems from user error, private key compromise, or exploit activity. The incident remains under analysis.
Coldcard Mk3 remains one of the most widely deployed hardware wallets among Bitcoin holders valuing air-gapped security. The device stores private keys offline and signs transactions without exposing seed phrases to internet-connected systems. A flaw in seed generation undermines this security model entirely.
Coinkite has not disclosed specifics about the vulnerability's nature or whether it affects only Mk3 units or earlier models. The company recommended users generate new wallets on alternative devices or newer Coldcard hardware and transfer their holdings immediately. Users holding significant Bitcoin positions face a time-sensitive decision.
The $38 million drain under examination adds urgency to custody discussions. Bitcoin address tracking reveals the funds moved without apparent authorization or on-chain explanation. Researchers investigate whether the wallet's private key suffered compromise through malware, physical device tampering, or exploitation of software vulnerabilities.
Hardware wallet security depends on multiple layers. Mk3's offline key storage and transaction signing provide protection against remote attacks, but seed-generation flaws can produce predictable keys vulnerable to brute-force derivation. If an attacker could generate valid seed phrases through computational analysis, they could recreate wallets and access funds.
The incidents highlight risks even within hardware wallet ecosystems. Users assuming cold storage guarantees absolute security face reality checks. Firmware vulnerabilities, manufacturing flaws, and compromised supply