Coinkite this week urged owners of its Coldcard Mk3 hardware wallet to migrate funds, citing a potential flaw in how the device generates seed phrases. The warning comes as Bitcoin security experts dig into an unexplained $38 million drain from a wallet — a case that's still unfolding.
Coldcard Mk3 seed risk
In a notice posted Wednesday, Coinkite said the Mk3's seed-generation process could be vulnerable under certain conditions. The company didn't specify the exact nature of the risk, but it told users to move their coins to a different wallet or a newer Coldcard model. The Mk3 has been on the market for years, and this is the first time Coinkite has flagged a seed-level issue.
The company said it's working on a firmware update, but for now the safest move is to transfer funds. No exploit has been confirmed in the wild, but the advisory is serious enough that Coinkite is urging immediate action.
The $38 million mystery
Separately, a Bitcoin wallet drained of roughly $38 million has caught the attention of security researchers. The transaction — a single, large outflow — was flagged by blockchain monitors earlier this week. The wallet's owner hasn't been publicly identified, and it's not clear whether the funds were stolen, moved by the owner, or lost to a bug.
Bitcoin security experts are examining the chain of transactions. Some are looking for links to known exchange hacks or wallet vulnerabilities. So far, no one has claimed responsibility, and no exchange has reported a breach of that size.
What users should do
For Coldcard Mk3 owners, the advice is straightforward: generate a new seed on a different device and move your bitcoin. Coinkite recommends using the Mk4 or another hardware wallet. If you're not sure which model you have, check the device label — the Mk3 has a distinct look.
As for the $38 million drain, there's not much the average user can do except keep an eye on their own wallets. The incident is a reminder that large, unexplained movements happen, and they often precede broader disclosures.
Security teams are still tracing the $38 million. Coinkite hasn't said when a full fix for the Mk3 will land. Both stories are developing.
