Coinkite issues security advisory for Coldcard Mk3 seed risk

Canadian hardware wallet manufacturer Coinkite has issued an urgent security advisory for users of its Coldcard Mk3 device, warning that seed phrases generated on specific firmware versions may be at risk. The company, in a statement published on July 30, 2026, advised users to migrate funds from wallets whose seeds were created on Mk3 firmware versions 4.0.1 through 5.0.3.

The warning coincides with independent investigations into a coordinated sweep of approximately 594.48 Bitcoin, valued at roughly $38.3 million, from hundreds of single-signature addresses. However, Coinkite and external researchers have not established a definitive public link between the firmware issue and the large-scale fund movement. The company stated its investigation remains active and a formal technical review is forthcoming.

According to Coinkite's early analysis, the potential vulnerability is confined to the Mk3 model. The company said its newer Mk4, Q, and Mk5 devices are not affected. The advisory also noted that seeds protected with a BIP39 passphrase-distinct from the device PIN-face minimal risk based on preliminary assessment.

The company provided detailed migration guidance for affected...