{"id":48891,"date":"2026-07-31T07:56:38","date_gmt":"2026-07-31T07:56:38","guid":{"rendered":"https:\/\/cryptomag.finance\/?p=48891"},"modified":"2026-07-31T07:56:38","modified_gmt":"2026-07-31T07:56:38","slug":"594-btc-drained-in-25-minutes-as-coldcard-flaw-sparks-alarm","status":"publish","type":"post","link":"https:\/\/cryptomag.finance\/?p=48891","title":{"rendered":"594 BTC drained in 25 minutes as Coldcard flaw sparks alarm"},"content":{"rendered":"

Coinkite has warned owners of its Coldcard Mk3 hardware wallet that any Bitcoin seed generated since March 2021 may be vulnerable after discovering a flaw that could make those seeds predictable. The warning came the same day about 594 BTC\u2014worth roughly $38 million\u2014was drained from around 500 wallets.<\/strong><\/p>\n

Users who purchased Coldcard primarily for its security features will right away want to know which models still maintain safety. At first, Coinkite only stated that the Mk3 was affected while new models like Mk4, Q, and Mk5 were dubbed \u201cnot affected based on our early analysis,\u201d as stated by The Block. However, in its later notice, the company mentioned that those newer models also create seeds with only 72 bits of entropy instead of 128 bits as was originally intended, albeit in a different way because of a different design.<\/p>\n

Which Coldcards are safe, and which are not<\/strong><\/h3>\n

The problem is associated with the firmware, not with the hardware.<\/p>\n

As reported<\/a> by Block\u2019s Bitcoin engineering and security team, Mk1 had never run buggy code. Also, Mk2 and Mk3 devices with firmware upgraded to 3.2.2 or later were generating their seed properly using a hardware random number generator.<\/p>\n

The vulnerability begins with the firmware version 4.0.0. Any Mk2 or Mk3 seed made using versions between 4.0.0 and 4.1.9 is considered a \u201cconfirmed vulnerable path,\u201d according to The Block, because the device did not reseed its source of randomness securely. Coinkite extends this warning until firmware version 5.0.3, which is the last version of firmware that supports the Mk3.<\/p>\n

For newer devices, the picture is less clear. The Block says the Mk4, Q, and Mk5 use entropy from a secure element but retain only four bytes of it, limiting the number of possible seed-generation paths. Coinkite says its Tapsigner, Opendime, and Satscard products use different codebases<\/a> and are unaffected.<\/p>\n

A $38 million sweep in 25 minutes<\/strong><\/h3>\n

The incident that attracted the attention of the public due to the security malfunction happened quickly.<\/p>\n

Roughly 500 wallets holding more than 0.15 BTC each had been drained on Friday between 01:31 and 01:56 UTC, many of which had been inactive for several years, with coins going back to the years between 2021 and 2026. Rob Hamilton, CEO of AnchorWatch, stated that he tracked a total of 1,324 spent outputs<\/a> in 500 transactions which took place across three blocks, with 562 BTC later consolidated into a single address.<\/p>\n

The figure might be greater. Block engineer Clay Garrett found an additional 695 transactions<\/a> that had the same signature as the verified thefts. The transactions supposedly moved 488.1 BTC altogether. Thus, if everything is linked, the total amount could be around 1,082 BTC. Coinkite has not yet verified whether or not the wallet drainage happened because of the fault in the firmware.<\/p>\n

How predictable randomness broke the seeds<\/strong><\/h3>\n

The Block found the source of the issue in the firmware configuration that turned off the Mk3\u2019s hardware random number generator. A library used alongside the firmware only checked if the configuration was present, but not if it was enabled or disabled, leading to the key generation reverting to a software method, which in this case relied on known public values such as the serial number and the clock registers of the device.<\/p>\n

The problem was traced by the company back to a code commit<\/a> that was dated March 1, 2021, which was included for the first time in version 4.0.0 of the firmware. The company stated that it came forward with its disclosure before it completed its testing because \u201cactive exploitation is underway.\u201d<\/p>\n

What Coinkite tells owners to do<\/strong><\/h3>\n

The recommendations from Coinkite rely on how the wallet was set up.<\/p>\n

According to Coinkite\u2019s preliminary assessment, users who have taken the precaution of using a separate BIP-39 passphrase along with a PIN have very little chance of losing their funds, unless they entered the passphrase into a smartphone, computer, or website.<\/p>\n

Everyone else is advised to move their funds. Coinkite suggests that users create a new seed on an uninfected device, check to ensure that backup and receive addresses are correct, send a small transaction, and only then move part of the remaining balance.<\/p>\n

In addition, the organization describes a sophisticated dice-roll method that eliminates the random number generator of the gadget, while at the same time, warns users against the hurry to move, as there are chances that mistakes in the recovery might trigger more damage than the vulnerability being discussed.<\/p>\n

Is there hope of recovering stolen Bitcoins?<\/h3>\n

That\u2019s a question that has only one sad answer: No. In hindsight, let\u2019s do this: Know your wallet like you built it. The \u201cbest wallet\u201d reviews<\/strong> come from independent security research, academic work, audits, and technical documentation from the vendors themselves.<\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Criterion<\/th>\nWhy it matters<\/th>\n<\/tr>\n<\/thead>\n
Entropy generation<\/td>\nWeak randomness can compromise seed phrases.<\/td>\n<\/tr>\n
Secure element<\/td>\nProtects private keys against physical extraction.<\/td>\n<\/tr>\n
Open-source firmware<\/td>\nEnables independent review and reproducible builds.<\/td>\n<\/tr>\n
Reproducible builds<\/td>\nLets users verify firmware matches published source code.<\/td>\n<\/tr>\n
Air-gapped signing<\/td>\nReduces exposure to network-based attacks.<\/td>\n<\/tr>\n
Security audits<\/td>\nShows whether external experts have evaluated the product.<\/td>\n<\/tr>\n
Vulnerability disclosure<\/td>\nIndicates how transparently the vendor communicates risks.<\/td>\n<\/tr>\n
Bug bounty<\/td>\nEncourages responsible reporting of flaws.<\/td>\n<\/tr>\n
Firmware update process<\/td>\nReflects how quickly vulnerabilities can be addressed.<\/td>\n<\/tr>\n
Recovery features<\/td>\nPassphrases and multisignature support can mitigate certain attack scenarios.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Figure 1. Vendors Documentation<\/p>\n

The strongest comparisons come from reading each vendor\u2019s technical documentation side by side. Instead of ranking wallets as \u201cbest,\u201d compare objective characteristics. That shifts the focus from subjective rankings to verifiable factors such as independent audits, reproducible firmware, certification, disclosure practices, and response to vulnerabilities\u2014criteria that are especially relevant in the wake of the Coldcard Mk3 incident.<\/p>\n

\u00a0<\/p>\n

If you’re reading this, you\u2019re already ahead. Stay there with our newsletter<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"

Coinkite has warned owners of its Coldcard Mk3 hardware wallet that any Bitcoin seed generated since March 2021 may be vulnerable after discovering a flaw that could make those seeds predictable. The warning came the same day about 594 BTC\u2014worth roughly $38 million\u2014was drained from around 500 wallets. Users who purchased Coldcard primarily for its […]<\/p>\n","protected":false},"author":1,"featured_media":48892,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"footnotes":""},"categories":[45],"tags":[],"class_list":["post-48891","post","type-post","status-publish","format-standard","has-post-thumbnail","category-bitcoin"],"yoast_head":"\n594 BTC drained in 25 minutes as Coldcard flaw sparks alarm - Cryptomag<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptomag.finance\/?p=48891\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"594 BTC drained in 25 minutes as Coldcard flaw sparks alarm - Cryptomag\" \/>\n<meta property=\"og:description\" content=\"Coinkite has warned owners of its Coldcard Mk3 hardware wallet that any Bitcoin seed generated since March 2021 may be vulnerable after discovering a flaw that could make those seeds predictable. The warning came the same day about 594 BTC\u2014worth roughly $38 million\u2014was drained from around 500 wallets. Users who purchased Coldcard primarily for its […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptomag.finance\/?p=48891\" \/>\n<meta property=\"og:site_name\" content=\"Cryptomag\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-31T07:56:38+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptomag.finance\/wp-content\/uploads\/2025\/06\/generic-crypto-image.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"560\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Crypto Magazine\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@cryptomagz\" \/>\n<meta name=\"twitter:site\" content=\"@cryptomagz\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Crypto Magazine\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48891#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48891\"},\"author\":{\"name\":\"Crypto Magazine\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\"},\"headline\":\"594 BTC drained in 25 minutes as Coldcard flaw sparks alarm\",\"datePublished\":\"2026-07-31T07:56:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48891\"},\"wordCount\":946,\"image\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48891#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/Coldcard-flaw-sparks-fears-after-38M-Bitcoin-wallet-drain-Nkcscq.webp\",\"articleSection\":[\"Bitcoin\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48891\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48891\",\"name\":\"594 BTC drained in 25 minutes as Coldcard flaw sparks alarm - Cryptomag\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48891#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48891#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/Coldcard-flaw-sparks-fears-after-38M-Bitcoin-wallet-drain-Nkcscq.webp\",\"datePublished\":\"2026-07-31T07:56:38+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48891#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/cryptomag.finance\\\/?p=48891\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48891#primaryimage\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/Coldcard-flaw-sparks-fears-after-38M-Bitcoin-wallet-drain-Nkcscq.webp\",\"contentUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/Coldcard-flaw-sparks-fears-after-38M-Bitcoin-wallet-drain-Nkcscq.webp\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=48891#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/cryptomag.finance\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"594 BTC drained in 25 minutes as Coldcard flaw sparks alarm\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#website\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/\",\"name\":\"Cryptomag\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/cryptomag.finance\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\",\"name\":\"Crypto Magazine\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"caption\":\"Crypto Magazine\"},\"sameAs\":[\"https:\\\/\\\/cryptomag.finance\",\"https:\\\/\\\/x.com\\\/cryptomagz\"],\"url\":\"https:\\\/\\\/cryptomag.finance\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"594 BTC drained in 25 minutes as Coldcard flaw sparks alarm - Cryptomag","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptomag.finance\/?p=48891","og_locale":"en_US","og_type":"article","og_title":"594 BTC drained in 25 minutes as Coldcard flaw sparks alarm - Cryptomag","og_description":"Coinkite has warned owners of its Coldcard Mk3 hardware wallet that any Bitcoin seed generated since March 2021 may be vulnerable after discovering a flaw that could make those seeds predictable. The warning came the same day about 594 BTC\u2014worth roughly $38 million\u2014was drained from around 500 wallets. Users who purchased Coldcard primarily for its […]","og_url":"https:\/\/cryptomag.finance\/?p=48891","og_site_name":"Cryptomag","article_published_time":"2026-07-31T07:56:38+00:00","og_image":[{"width":1000,"height":560,"url":"https:\/\/cryptomag.finance\/wp-content\/uploads\/2025\/06\/generic-crypto-image.webp","type":"image\/webp"}],"author":"Crypto Magazine","twitter_card":"summary_large_image","twitter_creator":"@cryptomagz","twitter_site":"@cryptomagz","twitter_misc":{"Written by":"Crypto Magazine","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cryptomag.finance\/?p=48891#article","isPartOf":{"@id":"https:\/\/cryptomag.finance\/?p=48891"},"author":{"name":"Crypto Magazine","@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040"},"headline":"594 BTC drained in 25 minutes as Coldcard flaw sparks alarm","datePublished":"2026-07-31T07:56:38+00:00","mainEntityOfPage":{"@id":"https:\/\/cryptomag.finance\/?p=48891"},"wordCount":946,"image":{"@id":"https:\/\/cryptomag.finance\/?p=48891#primaryimage"},"thumbnailUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/Coldcard-flaw-sparks-fears-after-38M-Bitcoin-wallet-drain-Nkcscq.webp","articleSection":["Bitcoin"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/cryptomag.finance\/?p=48891","url":"https:\/\/cryptomag.finance\/?p=48891","name":"594 BTC drained in 25 minutes as Coldcard flaw sparks alarm - Cryptomag","isPartOf":{"@id":"https:\/\/cryptomag.finance\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptomag.finance\/?p=48891#primaryimage"},"image":{"@id":"https:\/\/cryptomag.finance\/?p=48891#primaryimage"},"thumbnailUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/Coldcard-flaw-sparks-fears-after-38M-Bitcoin-wallet-drain-Nkcscq.webp","datePublished":"2026-07-31T07:56:38+00:00","author":{"@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040"},"breadcrumb":{"@id":"https:\/\/cryptomag.finance\/?p=48891#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptomag.finance\/?p=48891"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptomag.finance\/?p=48891#primaryimage","url":"https:\/\/cryptomag.finance\/wp-content\/uploads\/Coldcard-flaw-sparks-fears-after-38M-Bitcoin-wallet-drain-Nkcscq.webp","contentUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/Coldcard-flaw-sparks-fears-after-38M-Bitcoin-wallet-drain-Nkcscq.webp","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptomag.finance\/?p=48891#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptomag.finance\/"},{"@type":"ListItem","position":2,"name":"594 BTC drained in 25 minutes as Coldcard flaw sparks alarm"}]},{"@type":"WebSite","@id":"https:\/\/cryptomag.finance\/#website","url":"https:\/\/cryptomag.finance\/","name":"Cryptomag","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptomag.finance\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040","name":"Crypto Magazine","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","caption":"Crypto Magazine"},"sameAs":["https:\/\/cryptomag.finance","https:\/\/x.com\/cryptomagz"],"url":"https:\/\/cryptomag.finance\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts\/48891","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=48891"}],"version-history":[{"count":0,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts\/48891\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/media\/48892"}],"wp:attachment":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=48891"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=48891"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=48891"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}