Coinkite Warns COLDCARD Users Over Seed Flaw as 594.5 BTC Theft Raises Alarm

Highlights:

• Coinkite warned that seed phrases created on affected COLDCARD devices may expose some Bitcoin wallets to theft.
• Atlas21 reported an attacker drained 594.5 BTC from 500 single-signature addresses within about 15 minutes.
• Coinkite urged affected users to generate new seeds, update firmware, and carefully move their remaining funds.

Bitcoin hardware wallet maker Coinkite warned users on July 30, 2026, that seed phrases created on several affected COLDCARD devices may put funds at risk. The security notice came as Atlas21 reported that an attacker had drained 594.5 BTC from 500 Bitcoin addresses in about 15 minutes. Coinkite has not publicly confirmed that the device issue caused the theft, and its investigation remains ongoing.

A seed phrase is the set of words used to recover a crypto wallet. Its security depends on strong and unpredictable random data. Coinkite said affected devices may have created seeds with less randomness than expected, potentially making some private keys easier for an attacker to calculate.

Coldcard Mk3 Seeds Face the Highest Risk

Coinkite said the issue affects every COLDCARD Mk3 firmware version from 4.0.1, released in March 2021. Users who created a new seed on an Mk3 running that version or any later version should treat the wallet as potentially exposed.

The company also found that seeds generated on Mk4 and Mk5 devices before firmware version 5.6.0 may be affected. COLDCARD Q seeds created before version 1.5.0Q also fall under the warning. According to Coinkite, these models produced about 72 bits of entropy instead of the expected 128 bits. The issue is less severe on those newer devices than on the Mk3, but the company still described it as serious.

TAPSIGNER, OPENDIME and SATSCARD products are not affected because they use different software code.

COLDCARD Mk3 Security Advisory

If you generated a seed on a Mk3 after firmware 4.0.1, your funds may be at risk.

Mk4, Q and Mk5 are not affected based on our early analysis.

Read the advisory and migrate carefully:https://t.co/3vgPHOjMS7

— COLDCARD (@COLDCARDwallet) July 30, 2026

Atlas21 Links Theft Pattern to Weak Private Keys

Atlas21 said the July 30 theft occurred across four consecutive Bitcoin blocks. The attacker swept 1,324 unspent transaction outputs from 500 single-signature addresses and later consolidated 562 BTC into one address. No multisignature wallet was included among the reported victims.

The on-chain pattern raised concerns that the attacker may have calculated weak private keys rather than gaining direct access to each victim’s wallet. However, the exact attack method has not been confirmed.

Bitcoin developer James O’Beirne also urged users to move funds if their Bitcoin was protected by a single key generated on a Coldcard during the affected period. His warning mainly covered users who did not add dice rolls, use a strong passphrase or set up a multisignature wallet.

If you have bitcoin residing under a single key that was generated on a Coldcard Mk3 between 2021-2023, and you

– did not incorporate dice rolls
– do not use a passphrase
– do not use multi-sig

I would advise moving funds as soon as possible.

— James O'Beirne (@jamesob) July 30, 2026

Coinkite Tells Users to Create a New Seed

Coinkite advised affected users to move their Bitcoin to a new wallet created with a safe seed. Owners of Mk4, Mk5 or Q devices should first install firmware version 5.6.0 or later for Mk4 and Mk5, or version 1.5.0Q or later for Q. The company said an update cannot repair a seed that was already generated with affected firmware. Users should verify the new wallet, send a small test transaction and only then move the remaining balance.

People who added at least 50 fair, private and independent dice rolls when creating their final seed are not considered at risk from this random-number issue alone. However, anyone who cannot confirm the number or privacy of those rolls should migrate to a new seed.