Coldcard Mk3 seed generation vulnerability investigation
The developments in this story so far, most recent first.
-
Breaking
Coinkite warns Coldcard Mk3 users after $38M Bitcoin sweep
-
· date approximate Background
A user restored a seed generated on a Coldcard Mk3 onto a Coldcard Mk4 device.
In January 2026, a Reddit user reported that funds were drained from a wallet originally generated on a Coldcard Mk3 purchased in May 2021. The user noted that the seed in question had subsequently been restored onto a Coldcard Mk4 device.
According to reports, a seed created on an affected Coldcard remains weak even after it is restored onto a different brand's device. Coinkite has previously warned that seeds generated on Coldcard Mk3 firmware versions 4.0.1 or later may put funds at risk, and updating the firmware does not repair a seed that was already created on affected firmware.
-
· date approximate Background
A user purchased a Coldcard Mk3 device.
A Reddit user reported that funds were drained from a wallet containing a seed generated on a Coldcard Mk3 purchased in May 2021.
-
· date approximate Background
Coinkite released firmware version 4.0.1 for the Coldcard Mk3.
In March 2021, Coinkite released firmware version 4.0.1 for the Coldcard Mk3. Findings later indicated that a commit dated March 1, 2021, shipped in firmware 4.0.0 that month, involved a build setting that told the Coldcard device to skip its own hardware randomness generator.
Seeds created on a Coldcard Mk3 running firmware version 4.0.1, or any later Mk3 version, may put funds at risk. The issue originated from a flawed generator that also impacted paper wallet private keys, seed-splitting masks, device cloning keys, and Key Teleport transfers.