Coinkite warns Coldcard Mk3 users after $38M Bitcoin sweep

Block's security team identified the root cause as a build setting error in firmware version 4.0.0, introduced on March 1, 2021, which caused devices to bypass hardware randomness in favor of predictable software-based seeds. This flaw affects not only single-signature wallets but also paper wallet keys, seed-splitting masks, and device cloning processes. While both Coinkite and Block describe their analyses as preliminary, Block stated it released the findings early due to the active exploitation of roughly 594 bitcoin across 500 dormant wallets.

Block's security team identified the vulnerability as a build setting error originating in firmware 4.0.0 from March 2021, which caused devices to bypass hardware randomness in favor of predictable software-based seeding. The flaw, which affects seed generation for various Coldcard features including paper wallets and seed-splitting, stems from a library check that incorrectly validated the existence of a configuration setting rather than its activation. While Coinkite has acknowledged the preliminary findings, investigators confirm that 562 BTC of the total 594.48 BTC stolen has been consolidated into a single, stationary address.

Block's security team identified a critical flaw in Coldcard firmware dating back to version 4.0.0, which caused devices to skip hardware randomness and rely on predictable serial and clock data for key generation. Coinkite confirmed the vulnerability effectively reduced the seed search space for Mk3 devices to 40 bits and noted that newer models like the Mk4, Q, and Mk5 also suffer from reduced entropy. While emergency hotfixes have been released, officials emphasize that updating firmware does not secure seeds already generated on affected versions; users are urged to migrate funds immediately and utilize strong BIP-39 passphrases or additional dice-roll entropy to compensate.

Block's security team identified the vulnerability as a build setting in firmware 4.0.0 that caused the device to skip hardware randomness, relying instead on predictable serial numbers and clock registers. Coinkite warns that the flaw effectively reduces the seed search space of affected Mk3 units to approximately 40 bits, while newer models like the Mk4 and Q have improved but still insufficient entropy. Users are urged to move funds immediately, as a firmware update does not retroactively secure seeds created with the faulty version; additionally, Coinkite advises applying strong BIP-39 passphrases or manual entropy via dice rolls to mitigate risks.

The security flaw stems from a firmware build setting that caused devices to skip the hardware randomness generator, instead using a weak software substitute seeded from fixed serial numbers and clock registers. Coinkite has released emergency hotfixes—version 5.6.0 for Mk4/Mk5 and 1.5.0Q for the Q—though updating will not secure seeds already created on affected firmware. Experts suggest that using a strong BIP-39 passphrase or at least 99 dice rolls is necessary to protect funds, as even restoring an affected seed to a different device remains insecure.

Block's report reveals the vulnerability stemmed from a firmware build setting that caused devices to skip their hardware randomness generator, instead using a weak software substitute seeded by the chip's serial number and clock registers. While Coinkite has released emergency firmware hotfixes for Mk4, Mk5, and Q models, an update cannot repair seeds already created on affected firmware, leading experts to urge users to secure funds using strong BIP-39 passphrases or extensive dice rolls. Although the flaw impacts older seed generation, Tapsigner, Opendime, and Satscard remain unaffected.

The security flaw, traced to a 2021 firmware commit that caused devices to skip their hardware randomness generator, has led Coinkite to release emergency hotfixes for Mk4, Mk5, and Q models. While the flaw reduces the Mk3 seed search space to approximately 40 bits, Coinkite notes that updating firmware cannot repair already compromised seeds and recommends using a strong BIP-39 passphrase to secure funds. Additionally, Tapsigner, Opendime, and Satscard products remain unaffected by this specific vulnerability.

Block's report traces the flaw to a March 2021 build setting in firmware 4.0.0 that caused devices to skip the hardware randomness generator in favor of a weak software substitute. Coinkite has released emergency hotfixes—version 5.6.0 for Mk4/Mk5 and 1.5.0Q for the Q—though updating firmware will not secure seeds already created under the affected versions. To protect existing funds, users are advised to use a strong BIP-39 passphrase or at least 99 dice rolls, as affected seeds remain vulnerable even when restored to different hardware.

Block's investigation revealed that the flaw originated from a March 2021 firmware build setting that caused devices to skip hardware randomness in favor of a predictable software substitute. While Coinkite has released emergency firmware hotfixes for Mk4, Mk5, and Q models, the company warns that updating does not secure seeds already created on affected firmware. Consequently, users are advised to use strong BIP-39 passphrases or dice rolls to secure funds, as even seeds moved to different hardware brands remain vulnerable.

The vulnerability stems from a firmware build setting that caused devices to skip their hardware randomness generator in favor of a predictable software substitute seeded by serial numbers and clock registers. Coinkite has released emergency hotfixes (version 5.6.0 for Mk4/Mk5 and 1.5.0Q for Q), though users are warned that firmware updates cannot repair seeds already created on affected versions. While the flaw significantly reduces the Mk3 seed search space to approximately 40 bits, Coinkite recommends using a strong BIP-39 passphrase or extensive dice rolls to secure funds.

Block's investigation reveals the vulnerability stemmed from a firmware build setting that caused devices to skip the hardware randomness generator, instead using a weak software substitute seeded from serial numbers and clock registers. Coinkite has released emergency firmware hotfixes (version 5.6.0 for Mk4/Mk5 and 1.5.0Q for Q), though updating does not secure seeds already created on affected versions. While Mk4, Q, and Mk5 models offer improved search space due to secure elements, Coinkite recommends using strong BIP-39 passphrases to protect remaining funds.

Block's report traces the flaw to a March 2021 firmware update that caused devices to skip their hardware randomness generator in favor of a predictable software substitute. While Coinkite has released emergency hotfixes for Mk4, Mk5, and Q models, the company warns that updating firmware cannot repair seeds already created on affected versions. Additionally, Coinkite estimates the vulnerability reduces the Mk3 seed search space to approximately 40 bits, while later models like the Mk4, Q, and Mk5 offer improved but still insufficient security at roughly 72 bits.

Galaxy Research has revised the scale of the drain, identifying that 1,082.65 Bitcoin valued at approximately $70.2 million was lost across 1,196 addresses. This updated figure significantly exceeds the previously reported $38 million theft involving 594.48 BTC. The transactions, which occurred in a 41-minute window on July 30, shared a distinct pattern of identical fees and no change outputs.

Galaxy Research has updated the scale of the incident, reporting that 1,082.65 Bitcoin—valued at approximately $70.2 million—was lost across 1,196 addresses, a significant increase from the previously reported 594.48 BTC ($38 million) drain. The investigation revealed the theft occurred via 1,324 transactions within a 41-minute window on July 30, with patterns indicating a single attacker used a paid account at a prominent blockchain services provider to facilitate the sweeps. Coinkite has since acknowledged a firmware flaw that compromised seed generation and released emergency hotfixes, including version 4.2.0 for Mk3, 5.6.0 for Mk4/Mk5, and 1.5.0Q for Q devices.

Galaxy Research has updated the scale of the incident, identifying that 1,196 addresses lost a total of 1,082.65 Bitcoin, valued at approximately $70.2 million, during a 41-minute window on July 30. This significantly increases the previously reported loss of 594.48 BTC worth $38 million. Additionally, Coinkite has released emergency firmware hotfixes, including version 4.2.0 or later for Mk3, 5.6.0 or later for Mk4 and Mk5, and 1.5.0Q for Q devices, though users are warned that updating does not repair seeds already created on affected firmware.

Galaxy Research has revised the estimated impact of the drain, identifying 1,196 addresses that lost 1,082.65 Bitcoin, valued at approximately $70.2 million, during a 41-minute window on July 30. Coinkite has released emergency hotfixes—version 4.2.0 or later for Mk3, 5.6.0 or later for Mk4 and Mk5, and 1.5.0Q for Q—to remove the flawed software fallback path. Additionally, investigators report that the attacker may have used a paid account from a prominent blockchain services provider to query source addresses during the sweeps.

The scale of the theft has been significantly revised upward, with Galaxy Research identifying 1,082.65 Bitcoin valued at approximately $70.2 million lost across 1,196 addresses. A third wave of sweeps has also been flagged, involving roughly 208 bitcoin drained from 1,912 addresses between Friday midday and Saturday morning UTC. Additionally, Coinkite has released emergency firmware hotfixes, including version 5.6.0 for Mk4 and Mk5 and 1.5.0Q for Q, though developers warn that updating does not repair seeds already created on affected firmware.

Total losses from the Coldcard exploit have risen to 1,367 BTC, valued at approximately $89 million, across 4,585 addresses after a third wave of sweeps involving 208 BTC was identified. Coinkite has released emergency firmware hotfixes—version 5.6.0 for Mk4 and Mk5, 1.5.0Q for Q, and 4.2.0 or later for Mk3—though officials warn that updating does not secure seeds already created on compromised firmware. Additionally, investigators noted that the attacker used a paid account at a prominent blockchain-services provider to query source addresses during the theft.

Total losses from the Coldcard exploit have risen to 1,367 BTC, worth nearly $89 million, across 4,585 addresses following a third wave of sweeps involving 208 BTC. Coinkite has released emergency firmware hotfixes—version 5.6.0 for Mk4/Mk5, 1.5.0Q for Q, and 4.2.0 or later for Mk3—to remove the flawed software fallback path. Investigations revealed the attacker utilized a paid account at a prominent blockchain services provider to query source addresses during the theft, and Coinkite's co-founder warned that every mnemonic generated via the device since 2021 will be public within days.

Galaxy Research has updated the scale of the exploit, reporting that total losses across three waves of sweeps reached 1,367 BTC (approximately $89 million) from 4,585 addresses, significantly increasing the previously reported figures. A third wave of the attack was identified, involving the drainage of roughly 208 BTC from 1,912 addresses using different transaction patterns. Additionally, Coinkite has released emergency hotfixes for Mk4 (v5.6.0), Mk5 (v5.6.0), and Q (v1.5.0Q) devices, though users are warned that updating firmware cannot repair seeds already created on vulnerable versions.

Total losses from the Coldcard exploit have risen to 1,367 BTC, worth nearly $89 million, across 4,585 addresses following a third wave of sweeps. Unlike previous waves, this latest surge involved approximately 208 BTC being drained from 1,912 addresses, with funds being sent to individual destinations rather than shared collector addresses.

The total losses from the Coldcard exploit have risen to 1,367 BTC (approximately $89 million) across 4,585 addresses following a third wave of sweeps involving 208 BTC. Coinkite has released emergency firmware hotfixes—version 4.2.0 or later for Mk3, 5.6.0 or later for Mk4/Mk5, and 1.5.0Q for the Q—though these updates cannot repair seeds already created on compromised firmware. Additionally, Coinkite co-founder Rodolfo Novak warned that every mnemonic generated via a Coldcard since 2021 will be public within the next few days.

Total losses from the Coldcard exploit across three waves of attacks have risen to 1,367 BTC, worth nearly $89 million, affecting 4,585 addresses. Following the initial reported drain of 594.48 BTC, Galaxy Research identified additional waves involving 1,082.65 BTC and more recently 208 BTC. Coinkite has released emergency firmware hotfixes for Mk4, Mk5, and Q models, while advising Mk3 users to update to version 4.2.0 or later and increasing its security recommendation to at least 99 dice rolls.

Total losses across three waves of the Coldcard exploit have reached 1,367 BTC, worth nearly $89 million, affecting 4,585 addresses. Galaxy Research also identified a third wave of sweeps involving approximately 208 BTC from 1,912 addresses that occurred between Friday midday and Saturday morning UTC. Coinkite has since released firmware hotfixes for Mk4, Mk5, and Q models, and updated its security recommendation to use at least 99 dice rolls instead of the previously suggested 50.

The total loss from the Coldcard exploit has risen to 1,367 BTC, valued at nearly $89 million, spanning three waves of theft from 4,585 addresses. Galaxy Research confirmed that while the initial waves involved consolidated transfers, a third wave targeted 1,912 addresses to move approximately 208 BTC. Additionally, Coinkite has issued emergency firmware hotfixes for Mk4, Mk5, and Q models, while advising Mk3 users to update to version 4.2.0 or later.

Total losses from the Coldcard exploit across three waves of sweeps have reached 1,367 BTC, worth approximately $89 million, spanning 4,585 addresses. While initial reports estimated the loss at $38 million, Galaxy Research confirmed the expanded scale, noting that the third wave involved an additional 208 BTC being drawn from 1,912 addresses. All stolen funds currently remain in attacker-controlled addresses and have not been moved.

The total losses from the Coldcard exploit have escalated to 1,367 BTC (approximately $89 million) across 4,585 addresses following three documented waves of attacks. Galaxy Research also flagged a suspected fourth wave on Monday involving 218 transactions that moved roughly 388.9 Bitcoin from 462 potential victim addresses. Coinkite has since issued emergency firmware hotfixes for affected models and updated its security guidance, now recommending at least 99 dice rolls for users seeking to secure funds.

The total losses from the Coldcard exploit have reached 1,367 BTC, valued at nearly $89 million, across 4,585 addresses following three waves of sweeps. In a suspected fourth wave, Galaxy Digital flagged an additional 218 transactions impacting 462 potential victim addresses, moving approximately 388.9 Bitcoin. Coinkite has issued emergency hotfixes for various models, including version 5.6.0 for the Mk4 and Mk5 and 1.5.0Q for the Q, though users are advised that updating firmware does not repair seeds already created on affected versions.

Galaxy Research reported that total losses across three waves of the Coldcard exploit reached 1,367 BTC, valued at approximately $89 million, across 4,585 addresses. Additionally, a suspected fourth wave of attacks was flagged involving 218 transactions that impacted 462 potential victim addresses and moved roughly 388.9 Bitcoin.

Total losses from the Coldcard exploit have risen to 1,367 BTC, worth nearly $89 million, across 4,585 addresses spanning three documented waves. A suspected fourth wave of attacks was also identified, involving approximately 388.9 Bitcoin moved across 462 potential victim addresses through 218 transactions. Coinkite has since issued emergency hotfixes for Mk4, Mk5, and Q devices, and has halted all shipments of affected hardware.

Total losses from the Coldcard exploit across three waves have reached 1,367 BTC, valued at nearly $89 million, affecting 4,585 addresses. Additionally, a suspected fourth wave of attacks has been identified, involving approximately 388.9 Bitcoin across 462 potential victim addresses. Coinkite has also released emergency firmware hotfixes, including version 5.6.0 for Mk4/Mk5 and 1.5.0Q for Q, though officials warn that updating does not repair previously compromised seeds.

The Coldcard exploit has expanded through three documented waves, with Galaxy Research reporting total losses of 1,367 BTC (approximately $89 million) across 4,585 addresses. A suspected fourth wave of attacks was also flagged, involving 218 transactions that impacted 462 potential victim addresses and moved roughly 388.9 Bitcoin. Coinkite has since released emergency firmware hotfixes for Mk4, Mk5, and Q models, and adjusted its security recommendations to suggest at least 99 dice rolls for users seeking to secure funds.

Total losses from the Coldcard exploit have risen to 1,367 BTC, valued at nearly $89 million, across 4,585 addresses following three waves of sweeps. Galaxy Research also flagged a suspected fourth wave of attacks involving approximately 388.9 Bitcoin and 462 potential victim addresses. Additionally, Coinkite has released emergency firmware updates for the Mk4, Mk5, and Q models, while confirming that seeds generated on Mk2, Mk3, Mk4, Mk5, and Q devices are affected by the vulnerability.

Galaxy Research has updated the total impact of the Coldcard exploit, reporting that three waves of attacks resulted in a total loss of 1,367 BTC (nearly $89 million) across 4,585 addresses. Additionally, a suspected fourth wave has been identified, involving 218 transactions that moved approximately 388.9 Bitcoin from 462 potential victim addresses.

Total losses from the Coldcard exploit have risen to 1,367 BTC, valued at nearly $89 million, across 4,585 addresses spanning three documented waves. A suspected fourth wave of attacks has also been identified, involving approximately 388.9 Bitcoin from 462 potential victim addresses. Coinkite has confirmed that the vulnerability affects seeds generated on Mk2, Mk3, Mk4, Mk5, and Q devices, and has issued emergency hotfixes for Mk4, Mk5, and Q models, while providing specific guidance for Mk3 users.

Galaxy Research reported that total losses across all three documented waves of the Coldcard exploit reached 1,367 BTC, valued at nearly $89 million, across 4,585 addresses. Additionally, a suspected fourth wave of attacks has been flagged, involving approximately 388.9 Bitcoin across 462 potential victim addresses.

The scale of the Coldcard exploit has grown significantly, with Galaxy Research reporting total losses across three waves of attacks reached 1,367 BTC, worth nearly $89 million, from 4,585 addresses. Additionally, a suspected fourth wave of attacks has been flagged, involving approximately 388.9 Bitcoin moved across 462 potential victim addresses. Coinkite has also issued emergency firmware hotfixes—version 5.6.0 for Mk4 and Mk5, 1.5.0Q for Q, and 4.2.0 or later for Mk3—and now recommends that users secure funds using at least 99 dice rolls.

The total losses from the Coldcard exploit have risen to 1,367 BTC, valued at approximately $89 million, across 4,585 addresses following three documented waves of thefts. Additionally, a suspected fourth wave has been flagged involving approximately 388.9 Bitcoin moved across 462 potential victim addresses. Coinkite has issued emergency hotfixes for Mk4, Mk5, and Q devices, while recommending that users securing funds use a strong BIP-39 passphrase or at least 99 dice rolls.

The total loss from the Coldcard exploit has risen to 1,367 BTC, valued at nearly $89 million, across 4,585 addresses spanning three waves of attacks. A suspected fourth wave has also been identified, involving approximately 388.9 Bitcoin across 462 potential victim addresses. Coinkite has confirmed that the vulnerability affects seeds generated on Mk2, Mk3, Mk4, Mk5, and Q devices, and has released emergency firmware hotfixes for several models.

Confirmed losses from the Coldcard exploit have risen to over $100 million, with 1,596 BTC stolen from approximately 7,300 addresses across three major waves and 14 smaller incidents. This total surpasses the previous estimate of 1,367 BTC stolen across three waves, and officials noted that 90% of the stolen Bitcoin remains in attacker-controlled addresses.

Total confirmed losses from the Coldcard exploit have risen to 1,596 BTC worth over $100 million, stolen from approximately 7,300 addresses across three major waves and 14 smaller incidents. This follows an earlier report of 1,367 BTC stolen across three waves. Additionally, a suspected fourth wave of attacks was identified, involving 388.9 Bitcoin moved through 218 transactions affecting 462 potential victim addresses.

Confirmed losses from the Coldcard incident have escalated to over $100 million, with 1,596 BTC stolen from approximately 7,300 addresses across three major attack waves and 14 smaller incidents. In addition to the initial thefts, Galaxy Digital flagged a suspected fourth wave of attacks involving 388.9 BTC and 462 potential victims. Coinkite has since released emergency hotfixes—version 5.6.0 for Mk4 and Mk5, 1.5.0Q for Q, and version 4.2.0 or later for Mk3—though the company warns that updating firmware does not secure seeds already created on affected versions.

Total losses from the Coldcard exploit have escalated significantly, with Galaxy Research confirming that over 1,596 BTC (approximately $100 million) has been stolen from roughly 7,300 addresses across three major waves and 14 smaller incidents. This brings the confirmed loss well above the previously reported $70 million figure. Additionally, a suspected fourth wave of attacks has been flagged, involving approximately 388.9 Bitcoin from 462 potential victim addresses.

Total confirmed losses from the Coldcard exploit have risen to 1,596 BTC, valued at over $100 million, across three major waves and 14 smaller incidents involving approximately 7,300 addresses. In a suspected fourth wave of attacks, Galaxy Digital flagged an additional 218 transactions affecting 462 potential victim addresses, moving approximately 388.9 BTC. Additionally, Galaxy Research noted that 90% of the total stolen Bitcoin remains stationary in attacker-controlled addresses.

Total confirmed losses from the Coldcard exploit have reached 1,596 BTC (nearly $89 million) stolen from approximately 7,300 addresses across three major attack waves and 14 smaller incidents. Galaxy Research also identified a suspected fourth wave of attacks involving 388.9 BTC across 462 potential victim addresses. While initial reports estimated a $38 million drain, the scale of the incident has escalated significantly as investigators track the ongoing theft.

The scope of the Coldcard exploit has expanded significantly, with Galaxy Research confirming that total losses across three major waves reached 1,596 BTC (approximately $100 million) from 7,300 addresses, while a suspected fourth wave has also been identified involving approximately 388.9 BTC. Coinkite has responded by issuing emergency firmware hotfixes—version 5.6.0 or later for Mk4/Mk5, 1.5.0Q for Q, and 4.2.0 or later for Mk2/Mk3—and has halted all product shipments to destroy inventory containing the vulnerable firmware. Additionally, investigators noted that the attacker may have used a paid account at a known blockchain services provider to query source addresses during the sweeps.

Galaxy Research has reported that total confirmed losses from the Coldcard exploit have risen to 1,596 BTC, valued at over $100 million, across three major waves and 14 smaller incidents. Additionally, a suspected fourth wave of attacks was identified involving approximately 388.9 BTC and 462 potential victim addresses. Some estimates suggest that including this fourth wave, total losses could potentially reach $130 million.

Galaxy Research confirmed that total losses from the Coldcard exploit across three major waves have reached 1,596 BTC, valued at over $100 million, affecting approximately 7,300 addresses. A suspected fourth wave of attacks was also identified, involving around 388.9 BTC moved through 218 transactions across 462 potential victim addresses. While Coinkite has released emergency firmware hotfixes for affected models, the company warned that updating the firmware does not repair seeds already created on compromised versions.

Galaxy Research has confirmed that total losses from the Coldcard exploit have exceeded $100 million, with 1,596 BTC stolen across three major waves and 14 smaller incidents. This figure could potentially reach $130 million when accounting for a suspected fourth wave involving 388.9 BTC and 462 victim addresses. Additionally, Coinkite has released emergency firmware updates—version 4.2.0 or later for Mk2/Mk3, 5.6.0 or later for Mk4/Mk5, and 1.5.0Q or later for Q—and has halted all device shipments and destroyed existing inventory manufactured with the vulnerable firmware.

The total confirmed losses from the Coldcard exploit have escalated to 1,596 BTC (nearly $89 million) across three waves, though Galaxy Research estimates the total could reach $130 million including a suspected fourth wave of 388.9 BTC. Coinkite has released emergency firmware updates—version 4.2.0 or later for Mk2/Mk3, 5.6.0 or later for Mk4/Mk5, and 1.5.0Q or later for Q—and has halted all shipments of affected devices. Experts noted the vulnerability stems from a March 2021 firmware bug that bypassed the hardware random number generator in favor of a predictable software fallback, reducing seed entropy significantly.

Total losses from the Coldcard exploit have grown to 1,596 BTC (approximately $100 million) across 4,585 addresses following three major attack waves, with Galaxy Research suggesting a fourth wave could push the total to $130 million. Coinkite has released emergency hotfixes—version 5.6.0 for Mk4/Mk5, 1.5.0Q for Q, and 4.2.0 or later for Mk2/Mk3—and has halted all pending shipments of devices featuring the vulnerable firmware. While the flaw reduced seed entropy to as low as 40 bits on some models, Coinkite noted that users who utilized the device's physical dice-roll option for seed generation remain secure.

The scale of the Coldcard exploit has increased significantly, with Galaxy Research reporting total confirmed losses of 1,596 BTC (over $100 million) across three waves, involving 7,300 addresses. A suspected fourth wave of attacks has also been identified, involving approximately 388.9 BTC from 462 potential victim addresses, bringing the total estimated losses to roughly $130 million. Additionally, Coinkite has released emergency firmware hotfixes—version 5.6.0 for Mk4/Mk5, 1.5.0Q for Q, and 4.2.0 or later for Mk2/Mk3—though experts warn that updating does not repair seeds already compromised by the vulnerability.

Total losses from the Coldcard exploit have escalated to 1,596 BTC, worth approximately $100 million, following three major attack waves affecting 7,300 addresses. Evidence suggests a suspected fourth wave of attacks has also begun, potentially involving an additional 388.9 Bitcoin. Researchers noted that while the vulnerability stems from a 2021 firmware bug that bypassed hardware randomness, attackers may be using automated tools or large language models to facilitate these programmatic sweeps.

Galaxy Research has confirmed that total losses from the Coldcard exploit have exceeded $100 million, with 1,596 BTC stolen from approximately 7,300 addresses across three major waves and 14 smaller incidents. This total grew from the initial $38 million estimate, and researchers warn that including a suspected fourth wave, the total losses could reach approximately $130 million in Bitcoin. While the first three waves did not touch multisignature setups, Coinkite has since released emergency firmware updates and halted shipments of devices manufactured with the vulnerable software.

The scale of the Coldcard exploit has grown significantly, with Galaxy Research confirming total losses across three major waves reached 1,596 BTC (approximately $100 million) from 4,585 addresses, while a suspected fourth wave involving 388.9 BTC has also been flagged. The vulnerability, which stems from a March 2021 firmware error that bypassed the hardware random number generator, affects Mk2, Mk3, Mk4, Mk5, and Q devices. In response, Coinkite has released emergency hotfixes—version 5.6.0 for Mk4/Mk5, 1.5.0Q for Q, and 4.2.0 or later for Mk2/Mk3—and has halted all product shipments.

Total confirmed losses from the Coldcard exploit have risen to 1,596 BTC, valued at over $100 million, spanning three major attack waves and 14 smaller incidents. Galaxy Research also flagged a suspected fourth wave of attacks involving approximately 388.9 BTC and 462 potential victim addresses. Additionally, Coinkite has released emergency firmware updates, including version 4.2.0 for Mk2/Mk3, 5.6.0 for Mk4/Mk5, and 1.5.0Q for Q models, though users are warned that updating does not repair seeds already created on affected firmware.

Confirmed reports from Galaxy Research indicate that total losses from the Coldcard exploit have exceeded $100 million, with 1,596 BTC stolen from approximately 7,300 addresses across three major waves and 14 smaller incidents. A suspected fourth wave of attacks has also been flagged, involving approximately 388.9 BTC across 462 potential victim addresses, potentially bringing total estimated losses to $130 million. Additionally, Coinkite has released emergency firmware hotfixes—version 4.2.0 or later for Mk2/Mk3, 5.6.0 or later for Mk4/Mk5, and 1.5.0Q or later for Q—though users are warned that updating does not secure seeds already created on affected firmware.

The scope of the Coldcard exploit has expanded significantly, with Galaxy Research reporting total losses of 1,596 BTC (approximately $100 million) across three major waves, involving 4,585 addresses. A suspected fourth wave of attacks has also been flagged, involving approximately 388.9 BTC and roughly 462 potential victim addresses. Additionally, Coinkite has issued emergency firmware updates—version 4.2.0 or later for Mk2 and Mk3, 5.6.0 or later for Mk4 and Mk5, and 1.5.0Q or later for Q—and has halted all product shipments of affected devices.

The total confirmed losses from the Coldcard exploit have risen to 1,596 BTC, worth over $100 million, spanning three major waves and 14 smaller incidents across approximately 7,300 addresses. Galaxy Research also identified a suspected fourth wave of attacks involving around 388.9 BTC, which could push the total estimated losses to approximately $130 million. Additionally, Coinkite has released emergency firmware hotfixes, including version 5.6.0 for Mk4/Mk5 and 1.5.0Q for Q, though the company warned that updating firmware does not repair seeds already created on affected versions.

Galaxy Research updated its total loss estimate to 1,596 BTC ($100+ million) across 7,300 addresses, including a suspected fourth wave that moved 388.9 BTC from 462 addresses—each to a unique, previously inactive destination—while confirming that 90% of stolen funds remain unmoved; Coinkite also revised its firmware fix guidance, now requiring version 4.2.0+ for Mk2/Mk3, 5.6.0+ for Mk4/Mk5, and 1.5.0Q+ for Q devices, and emphasized that even dice-entropy seeds must use 99 rolls, not 50, to be secure.

Galaxy Research confirmed that total losses from the Coldcard exploit have risen to 1,596 BTC (~$100 million) across 7,300 addresses, including a suspected fourth wave that moved 388.9 BTC from 462 addresses with each victim’s funds sent to a unique, previously inactive destination—unlike earlier waves that consolidated funds—and that at least 15 distinct attackers are now identified, with some exploiting the flaw using automated tools that scan only default derivation paths, while the stolen funds remain largely unmoved in attacker-controlled addresses.

Galaxy Research confirmed that total losses from the Coldcard exploit have risen to 1,596 BTC ($100+ million) across 7,300 addresses, including a suspected fourth wave that moved 388.9 BTC from 462 addresses—this wave uniquely assigned each victim’s funds to a fresh, one-time destination address, unlike prior waves that consolidated funds, and was conducted at 45 times the pre-incident sweep rate, with attackers now targeting six addresses with years of prior activity; Coinkite also updated its guidance to recommend at least 99 dice rolls for entropy, not 50, and confirmed the vulnerability affects all Coldcard models with firmware from March 2021 onward, regardless of hardware revision.

Galaxy Research confirmed that total losses from the Coldcard exploit have risen to 1,596 BTC (approximately $100 million) across 7,300 addresses, including a suspected fourth wave that moved 388.9 BTC from 462 addresses—marking a shift from centralized collection addresses to unique, one-time destination addresses, and revealing that at least 15 distinct attackers have exploited the flaw, with some using replace-by-fee tactics and targeting addresses with years of prior activity.

Galaxy Research confirmed that total losses from the Coldcard exploit have risen to 1,596 BTC—worth over $100 million—across four attack waves, with a suspected fourth wave moving 388.9 BTC from 462 addresses, each to a unique, previously inactive destination, differing from earlier waves that consolidated funds; this wave also used replace-by-fee transactions and targeted only default derivation paths, while 90% of stolen BTC remain unmoved in attacker-controlled addresses.

Galaxy Research confirmed that total losses from the Coldcard exploit have risen to 1,596 BTC (~$100 million) across 7,300 addresses, including a suspected fourth wave that moved 388.9 BTC from 462 addresses — with funds sent to fresh, one-time destination addresses rather than centralized pools, and at a rate 45 times higher than pre-incident levels, while Coinkite acknowledged that AI-assisted code review, despite its recent failure to detect the flaw, is now outpacing human experts in uncovering such latent vulnerabilities.

Galaxy Research confirmed that total losses from the Coldcard exploit have risen to 1,596 BTC ($100+ million) across four attack waves, with the fourth wave—unconfirmed initially—moving 388.9 BTC from 462 addresses and using fresh destination addresses per victim, unlike prior waves that consolidated funds; additionally, researchers now suspect at least 15 distinct attackers exploited the flaw, and 90% of stolen BTC remain untouched in attacker-controlled addresses.

Galaxy Research confirmed that total losses from the Coldcard exploit have risen to 1,596 BTC (~$100 million) across 7,300 addresses, including a suspected fourth wave that moved 388.9 BTC from 462 addresses—each to a unique, previously inactive destination—while also revealing that at least 15 distinct attackers have exploited the flaw, with transaction patterns suggesting multiple independent operations rather than a single actor.

Galaxy Research confirmed that total losses from the Coldcard exploit have risen to 1,596 BTC ($100+ million) across four attack waves, with a suspected fourth wave draining 388.9 BTC from 462 addresses—each sent to unique, previously inactive destinations, unlike earlier waves that consolidated funds; the attacker also began using replace-by-fee transactions and targeting six reactivated addresses, while Coinkite updated its guidance to recommend at least 99 dice rolls for entropy, not 50, and disclosed that AI models like GLM 5.2 rediscovered the flaw in under 20 minutes without web access.

Galaxy Research confirmed that total losses from the Coldcard exploit have risen to 1,596 BTC ($100+ million) across four attack waves, with the fourth wave—unconfirmed initially—draining 388.9 BTC from 462 addresses using fresh destination addresses per victim, contrasting with earlier waves that consolidated funds; the attacker also began using replace-by-fee and targeting six previously active addresses, while Coinkite updated its firmware recommendations to require at least 99 dice rolls for entropy, up from 50.

Galaxy Research confirmed that total losses from the Coldcard exploit have risen to 1,596 BTC—worth over $100 million—across four attack waves, with a suspected fourth wave moving 388.9 BTC from 462 addresses, each to a unique, previously inactive destination, and the attacker now using replace-by-fee to accelerate transactions; the stolen funds remain largely untouched, and Coinkite has updated its recommendation to require at least 99 dice rolls for secure seed generation, up from 50.

Galaxy Research confirmed that total losses from the Coldcard exploit have risen to 1,596 BTC—worth over $100 million—across four attack waves, with a suspected fourth wave moving 388.9 BTC from 462 addresses, each to a unique destination, and attackers now using pay-to-witness-script-hash outputs to obscure fund movement; the number of affected addresses has grown to 7,300, and the attacker's average victim dormancy remains 3.18 years, with 90% of stolen BTC still unmoved.