Coldcard Mk3 vulnerability: Coinkite issued a security advisory warning that wallet seeds generated on Coldcard Mk3 devices running firmware versions 4.0.1 through 5.0.3 may be vulnerable. The Mk4, Mk5, and Q models are unaffected.
The warning comes as investigators examine a separate $38 million theft of 594.48 BTC from single-signature wallets, though no evidence has confirmed a direct link. Users are urged to migrate funds immediately.
What Coldcard users should do
Coinkite urged users to migrate to a new seed generated on an unaffected Mk4, Mk5, or Q device. For those unable to move immediately, creating a strong, unique BIP-39 passphrase (also known as “25th word”) on the Mk3 can serve as an interim measure.
To maximize security, the company warned against using quotations, familiar phrases, names, or reused passwords for passphrases. Users who generated seeds using dice rolls (an advanced method that bypasses the device’s random-number generator) are not affected.
Coinkite emphasized proceeding calmly and carefully: verify backups, test small transfers before moving larger balances, and keep old backups until the migration is confirmed.
The $38 million theft investigation
The warning coincides with a separate investigation into a coordinated sweep of 594.48 BTC from single-signature addresses. AnchorWatch CEO Rob Hamilton noted the sweep occurred across 500 transactions within a three-block window.
Kevin Loaec of Wizardsardine suggested a low-entropy random-number generator, potentially in a software library or device batch, may have produced insufficiently random wallet seeds. He hypothesized an attacker using AI-generated scripts to brute-force affected wallets.
Coinkite’s ongoing investigation has yet to produce a definitive link between the Mk3 issue and the theft.
The technical root cause: How the RNG failed
The technical team at Block figured out exactly what went wrong with the Mk3. Basically, there’s a firmware mix-up where the device’s random number generator (RNG) ends up using a predictable, software-based method known as (Yasmarang) instead of grabbing entropy from the STM32 hardware RNG. This backup plan is flawed because it relies on static or limited inputs, specifically things like the Microcontroller Unit Unique Identifier (MCU UID) and local timer registers.
When it comes to the Mk4 and Q models, the fix they rolled out was just a partial measure using a 32-bit secure-element reseed. That really doesn’t provide true cryptographic security, though, because it only results in 2^32 possible output streams, which is just too limited.
Bitcoin Core developer Instagibbs verified that the issue is fully reproducible and noted that it might even be a problem for the older Mk2 devices.
Because the entropy generation is so flimsy, it means that seeds generated on these impacted devices could theoretically be cracked by an attacker who knows exactly how the weakness works.
