Coldcard warns of seed-generation flaw in Mk3 wallets, urges immediate fund transfers

Hardware wallet manufacturer Coinkite has issued a security warning for its Coldcard Mk3 devices, advising users to transfer funds immediately due to a seed-generation vulnerability. The flaw affects wallets created on firmware versions 4.0.1 through 5.0.3, and could potentially expose private keys to risk. The warning comes as an ongoing investigation into a recent theft of 594 BTC from hundreds of single-signature wallets continues, according to Wu Blockchain.

Scope of the vulnerability

Coinkite’s advisory, published on its official channels, explains that the issue lies in the random number generation process used during wallet creation on the Mk3 series. If a wallet was initialized on a device running the affected firmware, the seed phrase may be generated with insufficient entropy, making it theoretically predictable. The company has not yet disclosed whether the vulnerability has been exploited in the wild, but the precautionary recommendation is to move all funds to a new wallet created on updated hardware or firmware.

Affected users are urged to:

• Immediately transfer all funds from any wallet created on a Coldcard Mk3 with firmware versions 4.0.1 through 5.0.3.
• Create a new wallet using a device with the latest firmware (5.0.4 or later) or a different hardware wallet.
• Securely wipe the affected device after confirming the balance is zero.

Context: Recent 594 BTC theft

The warning is tied to an ongoing investigation into a theft of 594 BTC (worth over $20 million at current prices) from hundreds of single-signature wallets. While the exact cause of that theft has not been officially confirmed, security researchers have been analyzing potential weaknesses in wallet generation processes. Coinkite’s proactive disclosure suggests that the vulnerability may be linked to this incident, although the company has not confirmed a direct connection.

This incident highlights a broader concern in the cryptocurrency community about the importance of secure random number generation in hardware wallets. Even a small flaw in entropy can undermine the entire security model of a device designed to protect private keys.

Why this matters to users

For Coldcard Mk3 owners, this is a critical moment. The device is widely regarded as one of the most secure hardware wallets on the market, and this vulnerability is a reminder that no device is infallible. The affected firmware versions span a significant period, meaning many users could be at risk. Coinkite’s swift response is commendable, but the onus is on individual users to act on the warning.

If you own a Coldcard Mk3, check your firmware version immediately. If it falls within the affected range, do not delay in moving your funds. The process of transferring to a new wallet is straightforward, but it must be done carefully to avoid exposing your keys during the transition.

Conclusion

Coinkite’s warning about the seed-generation flaw in Coldcard Mk3 wallets is a serious security advisory that requires immediate action. The potential link to the recent 594 BTC theft underscores the real-world consequences of such vulnerabilities. By transferring funds to a new wallet and updating firmware, users can mitigate the risk. This incident serves as a reminder that even the most trusted hardware wallets can have flaws, and staying informed is key to protecting your assets.

FAQs

Q1: How do I check my Coldcard Mk3 firmware version?
To check your firmware version, navigate to the ‘Advanced’ menu on your Coldcard, then select ‘Firmware’. The version number will be displayed. If it is between 4.0.1 and 5.0.3, your device is affected.

Q2: What should I do if my wallet is affected?
Immediately transfer all funds to a new wallet created on a device with firmware 5.0.4 or later, or to a different hardware wallet. After confirming the balance is zero, securely wipe the affected device to prevent any potential key compromise.

Q3: Is the vulnerability being actively exploited?
Coinkite has not confirmed active exploitation, but the recent theft of 594 BTC is under investigation, and the company advises treating the risk as real. It is best to act as if your funds are at risk and move them without delay.