Coinkite warned users of its Coldcard Mk3 hardware wallet to migrate funds generated on firmware versions 4.0.1 through 5.0.3, citing a potential seed-generation flaw. The warning followed an unexplained sweep of 594.48 BTC — approximately $38 million — from single-signature addresses in a three-block window. A Reddit user reported that funds were drained from a wallet whose seed was created on a Mk3 device purchased in May 2021, though no public evidence has confirmed a direct connection between the firmware issue and the coordinated sweep. Coinkite stated that Mk4, Q and Mk5 models are not affected and urged users to generate a new seed on an unaffected device before moving funds.
This is hardware wallet vulnerability risk, not a Bitcoin network or exchange failure, and it matters because it shows how vendor-specific implementation flaws can create silent exposure years after initial setup. AnchorWatch CEO Rob Hamilton noted that 1,324 unspent outputs were swept across 500 transactions, with 562 BTC later consolidated into a single address, describing the pattern as consistent with flawed entropy during wallet generation. Wizardsardine CEO Kevin Loaec hypothesized that a low-entropy random number generator may have produced seeds with insufficient randomness, enabling an attacker to brute-force a limited range of BIP-84 derivation paths — which would explain why the sweep appears concentrated in native SegWit addresses and why some wallets were only partially drained. If Loaec's hypothesis is correct, wallets that lost a portion of their balance may remain at risk of further theft if the attacker expands the scan to other address types.
For traders, this does not create a directional trade on BTC but it does shift custody risk assessment for the weeks ahead. Hardware wallet exploits could trigger short-term selling pressure from affected users moving to new setups, and if the sweep expands or additional vendors confirm similar flaws, that could feed into broader risk-off rotation. Funding sits at +1.0bp, ten times the 30-day average of +0.1bp, showing that leverage remains skewed long despite Fear & Greed at 25 — a mismatch that leaves BTC vulnerable to deleveraging if custody concerns intensify. Coinkite's recommendation to migrate funds using a small test transaction first suggests the company believes the exposure warrants immediate action.
Watch for two things: whether additional hardware vendors issue similar warnings, which would signal a broader supply-chain or cryptographic library issue, and whether on-chain data shows an acceleration in the consolidation pattern that Hamilton and Loaec identified. If the sweep resumes or expands to other address types, expect selling pressure from users racing to move funds. The baseline scenario is that this remains a narrow vendor issue affecting a specific firmware window, but the mechanism — flawed entropy in seed generation — is the type of silent vulnerability that can sit undetected across multiple products, and that uncertainty is what makes this event worth tracking even without a clean trade setup.
Source: CoinTelegraph