加密货币Neutral$BTC

Coldcard Mk3 Warning Amid Unexplained 594 BTC Sweep

Bitcoin security experts said the unexplained $38 million wallet drain may involve flawed seed-generation entropy, though the cause and any Coldcard link remain unconfirmed.

YayaNewsFinancial news writer2026-07-31 10:54Updated: 2026-07-31 10:540 ViewsSource CoinTelegraph

YayaNews contributes financial news and market context through the YayaNews editorial workflow.

Bitcoin security experts said the unexplained $38 million wallet drain may involve flawed seed-generation entropy, though the cause and any Coldcard link remain unconfirmed.

Coldcard Mk3 Warning Amid Unexplained 594 BTC Sweep

DOGE

$0.07003

0.80%

TRX

$0.3284

0.79%

LINK

$8.36

0.12%

ZEC

$461.94

2.05%

ADA

$0.1706

4.59%

XRP

$1.08

0.38%

ETH

$1,904.67

0.41%

BTC

$64,315.96

0.13%

XMR

$355.93

0.91%

BNB

$588.29

2.18%

XLM

$0.1704

1.02%

SOL

$74.18

0.36%

HYPE

$55.06

1.97%

Written by

Ezra Reguerra

staff writer

Reviewed by

Yohan Yun

staff editor

Written by

Ezra Reguerra

staff writer

Reviewed by

Yohan Yun

staff editor

Coldcard issues Mk3 warning as experts examine $38M Bitcoin wallet drain

Latest News

Published

Jul 31, 2026

Coinkite urged Coldcard Mk3 users to migrate funds after identifying a potential seed-generation risk, as Bitcoin security experts separately examine an unexplained $38 million wallet drain.

Canadian Bitcoin hardware maker Coinkite has warned users of its Coldcard Mk3 signing device to move funds from wallets whose seed phrases were generated on affected firmware.

On Thursday, Coinkite

said

seeds created on an Mk3 running firmware version 4.0.1, released in March 2021, or any later Mk3 version may put funds at risk. The issue extends through version 5.0.3, the final firmware supporting the Mk3, while the Mk4, Q and Mk5 are not affected, according to the company’s early analysis.

The warning comes as Bitcoin security specialists examine an unexplained, coordinated sweep involving 594.48 BTC from single-signature addresses. However, no definitive public evidence has established that the Mk3 issue caused those transfers.

“Out of an abundance of caution,” Coinkite urged affected users to generate a new seed on an unaffected device, verify its backup and receive address, send a small test transaction and only then move the remaining funds. The company said its investigation is ongoing and promised a formal technical review.

Coinkite said its early analysis indicates that affected seeds used with a BIP-39 passphrase face minimal risk, stressing that this refers to a passphrase rather than the Coldcard PIN.

Experts examine 594 BTC sweep

The sweep attracted attention after a Reddit user

said

funds had been drained from a wallet whose seed was generated on a Coldcard Mk3 bought in May 2021.

The user said the seed was later restored onto a Coldcard Mk4 in January 2026, meaning it had subsequently been entered into a second device. The account is self-reported and does not establish a connection between Coldcard and the broader sweep.

In a preliminary analysis posted on Friday, AnchorWatch CEO and co-founder Rob Hamilton

said

that 1,324 unspent transaction outputs were swept across 500 transactions within a three-block window, moving 594.48 BTC.

At the time of writing, the 594.48 BTC was worth approximately $38.3 million, based on a Bitcoin price of $64,364.07,

according

to CoinGecko.

Hamilton said all the addresses involved were single-signature and that 562 BTC was later consolidated into another address. “At a glance, this looks like there was flawed entropy in wallet generation somewhere along the way,” he wrote.

Thousands of crypto wallets at risk from ‘Ill Bloom’ vulnerability: Coinspect

Separately, Wizardsardine CEO Kevin Loaec

said

his current hypothesis is that a low-entropy random-number generator, potentially in a software library, secure element or particular device batch or firmware version, produced wallet seeds with insufficient randomness.

He suggested that an attacker who knew of the flaw may have used an AI-generated script to brute-force affected wallets, but searched only a limited range of BIP-84 derivation paths. That could explain why the sweep appears concentrated in native SegWit addresses and why some wallets were only partially drained, though Loaec stressed that the theory remains unconfirmed.

Loaec warned that, if his hypothesis is correct, wallets that were only partially drained may remain at risk of further theft. He added that funds held in other address types could also be exposed if the attacker expands the scan to include them.

Magazine:

Inside the ‘fake police raid’ that forced a $1M Bitcoin transfer

Subscribe to daily byte-sized crypto news from Cointelegraph

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s

Editorial Policy

and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

Wallet

Hacks

Security

Cybersecurity

Bitcoin