Some Coldcard Mk3 owners may need to move their Bitcoin. Coinkite says funds tied to seeds generated on firmware 4.0.1 or a later Mk3 release may be at risk.
Bitcoin Core contributor instagibbs said he recreated the vulnerable seed on a newly initialized Mk3. Coinkite says Mk4 and Mk5 devices are also affected before firmware 5.6.0, while Q devices are affected before 1.5.0Q; the impact is less severe but still serious. The company plans a formal technical review of the root cause.
A hardware wallet protects an existing key through secure storage, offline signing, and on-device verification. Seed generation precedes those defenses and determines whether the device starts with strong key material.
A seed phrase draws security from entropy, the randomness that selects one combination from an immense field. Weak randomness narrows that field until an attacker can test candidate seeds, derive their addresses, and watch for deposits from another computer.
Predictable creation defeats the air gap at the starting point and turns theft into a remote search problem. An attacker can work from candidate seeds, monitor the corresponding addresses, and spend the funds once a match appears.
Because every existing address remains controlled by the original seed, remediation requires new keys and an on-chain transfer. Updated firmware can secure future setup flows, but it cannot change the key material controlling old addresses.
| Security layer | What it protects | Why it failed to solve this case |
|---|---|---|
| Air gap | Prevents the device from exposing keys over a live connection | Does not help if the seed was predictable at creation |
| Secure storage | Keeps an existing private key isolated | Protects the wrong thing if the original key material is weak |
| Offline signing | Lets users approve transactions without connecting the wallet | Only protects spending after the seed already exists |
| On-device verification | Lets users confirm addresses and amounts on the hardware screen | Does not prove the seed was generated with enough entropy |
| Firmware update | Can improve future device behavior | Cannot replace old addresses controlled by an already-generated seed |
| New seed + transfer | Creates fresh key material and moves funds away from old addresses | Only complete remediation path for potentially weak seeds |
The highest-risk custody profile
The clearest exposure profile begins when an affected Mk3 generated the seed and one signature controls the wallet. Zero dice entropy, zero BIP-39 passphrase, and zero multisig leave the device’s seed generator as the only cryptographic root.
Coinkite says a strong, unique BIP-39 passphrase adds an independent barrier, while short, common, patterned, quoted, or reused passphrases may be guessable. The passphrase differs from the device PIN and derives a separate wallet from the same mnemonic, so an attacker must recover both secrets. Even with a strong passphrase, Coinkite advises migrating to a newly generated seed.
A multisig can confine a single weak seed to a single signer when the spending threshold requires independent keys. User-supplied dice can add an external entropy source, and Coinkite’s advanced path specifies at least 99 fair rolls through its dice-only import flow.
Those protections demand careful records and tested recovery. A lost passphrase can lock out the owner, a poorly documented multisig wallet can complicate recovery, and exposed dice records can disclose the replacement seed.
Coinkite tells users to verify the backup, fingerprint, and receive address, send a small test payment, then move the balance. That sequence limits the chance that urgency causes a second failure due to a mistyped address, a weak temporary wallet, or an incomplete backup.
| Custody setup | Risk level | Why it matters |
|---|---|---|
| Mk3-generated seed, single-sig, no passphrase, no dice, no multisig | Highest | The affected seed is the only cryptographic root protecting the wallet |
| Mk3-generated seed with BIP-39 passphrase | Lower only with a strong, unique passphrase | The attacker would need both the mnemonic and the separate passphrase |
| Mk3-generated seed with multisig | Lower if other signers are independent | One weak seed is not enough to spend if the threshold requires other keys |
| Mk3-generated seed with user-supplied dice entropy | Lower if at least 50 fair, private rolls were added | Fewer than 50 rolls, or uncertainty about the rolls, still requires migration |
| New seed on unaffected device | Remediation path | Funds move to fresh key material outside the affected setup |
| Panic migration to unverified wallet or address | New failure risk | Urgency can create losses unrelated to the original flaw |
Cold storage acquires a maintenance schedule
Coinkite released the final Mk3 firmware in June 2023, and its July 2026 advisory covers seeds that Mk3 devices created from March 2021 onward, placing a three-year gap between product support and an urgent custody action.
That gap turns cold storage into a legacy-maintenance problem. Dormant holders may power on a device once every few years, old product pages lose visibility, and owners may miss manufacturer notices for months.
Whoops, looks like there was a problem. Please try again.
You’re subscribed. Welcome aboard.
A seed can outlive its device, firmware branch, and original support channel, so custody systems need durable alerts and repeatable migration procedures. Manufacturers can publish entropy architecture, device-specific advisories, and key-rotation playbooks that stay accessible for years beyond the final sale.
Coinkite’s security documentation describes open code and reproducible builds as inspection tools. Reviewers can compare the source with the released binaries, and defects can persist until someone studies the exact code path that generated a dormant seed.
That distinction makes independent entropy testing a core hardware-wallet practice. A reproducible binary tells a buyer which code ran, and assurance about every security assumption requires separate testing.
In the bull case, affected users rotate keys carefully, Coinkite publishes the root cause, and wallet makers adopt stronger entropy tests and durable alert channels. Passphrases, multisig, and independent randomness gain broader use, giving holders several cryptographic barriers around one balance.
| What happens next | Bull-case outcome | Bear-case outcome |
|---|---|---|
| User migration | Affected users rotate keys carefully after test transactions | Dormant users miss the advisory and keep receiving funds to old addresses |
| Root-cause review | Coinkite publishes a clear technical explanation | Uncertainty widens around old firmware or device assumptions |
| Passphrase adoption | More holders add a second secret to cold storage | Lost or poorly recorded passphrases create recovery failures |
| Multisig adoption | Large balances move away from single-device failure points | Poorly documented multisig setups create operational risk |
| Entropy testing | Manufacturers improve public testing of seed-generation paths | Users continue assuming reproducible builds prove randomness quality |
| Alert systems | Wallet makers build durable advisory channels for old devices | Security notices remain easy for long-term holders to miss |
| Market narrative | The issue becomes a custody-process upgrade moment | Unverified theft claims and panic transfers dominate the story |
In the bear case, dormant Mk3 wallets continue to receive deposits using old seeds, and owners discover the advisory through theft reports or emergency outreach. Panic transfers create extra losses through unverified addresses, weak temporary wallets or misplaced backups, and unsupported claims tie unrelated on-chain movements to the flaw.
Hardware wallets made self-custody practical by protecting keys during storage and spending.
Now, the Coldcard warning extends that security model across setup, monitoring, and rotation, turning every seed into a long-term maintenance obligation that can outlive the device that created it.
