Coldcard warns of potential seed phrase risk in its Mk3 hardware wallet, while security experts are investigating an anomalous BTC transfer worth $38.3 million.

Canadian hardware wallet manufacturer Coinkite has issued a security warning, advising users who generated mnemonics using Coldcard Mk3 with firmware versions 4.0.1 to 5.0.3 to migrate their assets as soon as possible. The company stated that initial analysis shows wallets using BIP-39 passphrases carry lower risk, while Mk4, Q, and Mk5 devices are unaffected. The investigation is still ongoing. Meanwhile, security researchers are probing an unusual transfer involving 594.48 BTC (approximately $38.3 million). AnchorWatch CEO Rob Hamilton noted that the attacker transferred 1,324 UTXOs across 500 transactions over 3 blocks, speculating the issue may stem from insufficient random number entropy during wallet generation. Wizardsardine CEO Kevin Loaec argued the vulnerability could be related to low-entropy random number generators in a software library, secure chip, specific device batch, or firmware version, with attackers potentially using AI-generated scripts to brute-force affected wallets. No conclusive evidence has yet confirmed a direct link between this fund transfer and the Coldcard Mk3 vulnerability.