Coinkite, a manufacturer of hardware Bitcoin wallets, announced the discovery of a critical security vulnerability that could affect the security of seed phrases generated on some Coldcard Mk3 devices. The company recommends that users who may be at risk immediately transfer their funds to a new, more secure wallet.
According to Coinkite, the issue is related to the seed generation process on Coldcard Mk3 devices with firmware versions from 4.0.1 to 5.0.3. Users who previously generated seeds on these devices should consider that all Bitcoin addresses associated with that seed are potentially compromised.
The warning comes amid an ongoing investigation into an attack that resulted in a large amount of $BTC being stolen from hundreds of single-signature Bitcoin wallets. While initial reports indicated a theft of approximately 594 $BTC, a broader analysis by Galaxy Research suggests that 1,196 wallets were completely drained, with the total amount of compromised $BTC reaching 1,082.65 $BTC. At the time of the transactions, this amount was valued at approximately $70.2 million.
According to Galaxy Research data, the wallets were drained in just 41 minutes on July 30. The fact that all transactions used the same fee of 30 sat/vB and that no change was created in any of the transactions suggests the transfers might not have been manual actions by users but executed by an automated tool scanning for compromised private keys.
Reportedly, the stolen Bitcoins were concentrated into four different addresses, and no activity has been observed from these addresses so far. Notably, the attack occurred roughly 30 hours before Coinkite publicly disclosed the Coldcard Mk3 vulnerability.
Security experts recommend that Coldcard Mk3 users who created a seed phrase on the device no longer consider the old seed phrase secure. Users are advised to create a new seed phrase in a trusted and modern hardware wallet and then transfer all funds to this new address. Simply switching devices is not considered sufficient; the old seed phrase should not be imported into the new wallet.
*This is not investment advice.
