Security Concerns Rise Over Potential Coldcard Mk3 Vulnerability
A major Bitcoin theft has raised fresh concerns regarding hardware wallet security after approximately 594 BTC, valued at around $38 million, was drained from hundreds of wallets during a coordinated attack.
The incident took place over roughly 25 minutes, with blockchain analysts reporting that funds from nearly 500 single-signature Bitcoin wallets were swept across multiple transactions and consolidated into a single address. Security researchers are actively investigating whether the breach is linked to a potential vulnerability affecting certain Coldcard Mk3 hardware wallets.
Investigation Into Firmware Flaw and Randomness Issue
Early blockchain analysis revealed that the attacker rapidly transferred more than 1,300 UTXOs across several Bitcoin blocks to consolidate the stolen assets. Many of the compromised wallets had been inactive for years, with some coins dating back to 2021. Because of the speed and coordination of the attack, investigators believe the wallets shared a common weakness.
Preliminary findings indicate that researchers are examining a historical randomness (entropy) issue in certain Coldcard Mk3 firmware versions. According to security experts, this alleged flaw could have reduced randomness during seed generation under specific circumstances, making certain private keys more predictable.
Manufacturer Recommendations
In response to the incident, Coldcard manufacturer Coinkite recommended that users who generated recovery seeds on potentially affected firmware versions take precautionary steps:
- Generate a new recovery seed using updated hardware or firmware.
- Move funds to newly created wallets.
- Verify backups prior to transferring assets.
- Ignore unsolicited recovery offers or support messages.
Coinkite’s preliminary assessment indicates that newer Coldcard models are not affected by the issue. Despite the scale of the theft, Bitcoin’s price showed minimal reaction, leaving the broader cryptocurrency market relatively stable while investigations continue.
