594 BTC Swept in 25 Minutes: Coldcard's Mk3 Seed Flaw Turns the Hardware Wallet Inside Out

What Happened

Between 01:31 and 01:56 UTC on Thursday, July 30, an attacker swept roughly 594.5 BTC, worth about $38.3 million, out of approximately 500 single-signature Bitcoin addresses. The sweep pulled more than 1,300 unspent transaction outputs (UTXOs) across 4 consecutive blocks, 960188 through 960191, and onchain analysts watched 562 BTC of the proceeds consolidate into a single address shortly afterward.

The pattern ruled out the usual suspects almost immediately: no phishing campaign reaches 500 unrelated wallets in the same 25 minutes, and no exchange was involved. Whoever built those transactions already held the keys.

Within a day, Coinkite, the maker of the Coldcard hardware wallet, published a security advisory warning that seeds generated on its Mk3 device running firmware version 4.0.1 (released March 2021) through 5.0.3 'may be at risk.' The advisory points to a possible flaw in how the device sourced randomness during seed generation.

Coinkite has not confirmed that the flaw caused the sweep, but multiple independent analysts connected the drained addresses to weak-entropy seeds, and the company's own remediation guidance treats the threat as live: it urges Mk3 users to add a strong BIP-39 passphrase immediately and migrate funds to a fresh seed on newer hardware.

A hardware wallet exists to make trust unnecessary. Seed generation is the one step you cannot verify by looking, and for more than 4 years that is where the trust was hiding.

The Randomness That Wasn't

A Bitcoin seed is only as strong as the randomness that produced it. A standard 12-word mnemonic under BIP-39 (the Bitcoin Improvement Proposal that defines how seed words encode a master key) should represent 128 bits of entropy: a number space so large that guessing is physically impractical.

According to coverage of the advisory, affected Mk3 devices fell back to predictable software-based generation seeded partly by non-secret chip data instead of drawing on dedicated hardware randomness. Published estimates of the resulting effective entropy vary, but all of them fall far below the security margin the device promised, and the sweep itself suggests the reduced space was searchable in practice: an attacker could precompute candidate seeds, derive their addresses, and watch the blockchain for matches.

That failure mode explains the sweep's signature: hundreds of unrelated wallets, emptied in a single coordinated window, with no malware, no phishing, and no physical access to any device. An attacker who has spent months grinding through a weakened seed space does not need to touch a victim.

They already hold the same keys the victims do, and they can wait to collect everything at once, which maximizes the take and eliminates any warning period. Early signs indicate that is what happened here, though attribution and exact method remain unconfirmed as of this writing.

When the Protection Layer Becomes the Attack Surface

The Coldcard Mk3 was not an obscure device. It was one of the most respected signing tools in Bitcoin, marketed to exactly the kind of user who takes key control seriously, and this series exists to track what happens when protective mechanisms invert into attack surfaces. This is the purest example yet.

The air gap held. The secure element held. The tamper-evident packaging held. The seed the device generated was the vulnerability, and nothing in the user-facing experience distinguished a weak seed from a strong one for more than 4 years. Every downstream discipline (verifying addresses on the device screen, checking firmware signatures, keeping the device offline) sat on top of a foundation that was narrower than anyone could see.

The strongest counter-argument deserves airing. Coinkite founder Rodolfo Novak, known as NVK, has rejected characterizations of a device-wide cryptographic breach, noting that the swept funds appear to involve compromised or weak seeds spanning keys from more than one wallet type, and the advisory's own language remains conditional.

He may be right that the affected population is narrower than the headlines suggest, and the honest reading is that the full post-mortem is not yet written. But from an individual holder's perspective the distinction changes nothing about the required response: when the manufacturer of your signing device tells you your seed may be predictable, the rational move is to treat it as compromised and rotate.

Hope is not a key-management strategy.

What This Means for You

If you generated a seed on a Coldcard Mk3 running firmware 4.0.1 through 5.0.3, treat that seed as burned and move your funds. A firmware update does not fix an existing seed; the weakness is baked into the words themselves. Coinkite's guidance is sequenced: first, add a strong, unique BIP-39 passphrase on the device now, which places a second secret between an attacker's precomputed seed table and your coins.

Then migrate to a fresh seed generated on a Mk4, Mk5, or Q, which use a different generation path and are not affected. If you must stay on Mk3 hardware, Coinkite documents an advanced alternative: generate the replacement seed with the dice-roll feature, entering at least 99 independent rolls of a fair 6-sided die, which hashes your physical rolls directly and bypasses the device's random number generator entirely.

Whichever path you take, execute the migration like it matters: build the new wallet, send a small test amount, verify you can spend from it, and only then move the balance. Do not type the old seed into a computer to speed things up, and do not reuse the old wallet for change outputs.

If your Mk3 seed already sits behind a strong passphrase, your exposure to pure seed-search attacks is sharply lower, but the migration is still the correct endpoint.

The broader lesson applies to every self-custody setup, whatever hardware you run. Seed generation is the single moment where you cannot verify what the machine did. You can verify receive addresses, verify transactions on the screen, and verify firmware signatures, but you cannot eyeball whether 128 bits of entropy were real.

The 2 practical hedges are dice-roll seed generation, which moves the randomness into your own hands, and multi-sig across devices from different vendors, which turns any single manufacturer's mistake into a survivable event instead of a total loss. Self-custody remains the right architecture; this week is a reminder that it is an architecture, not a product you buy once.

What to Watch

Watch for Coinkite's full post-mortem, which should specify the exact entropy failure and the true size of the exposed population, and watch whether the swept coins move from the consolidation address toward mixers or exchanges, which would open attribution and recovery paths. Watch whether other hardware wallet vendors respond with independent audits of their own seed-generation code, because the failure pattern here (a silent fallback from hardware to software randomness) is not unique to any one vendor's architecture.

Based on the documented pattern in prior wallet-entropy failures, the swept coins are likely gone; the live question is how many weak seeds remain unswept, and whether their owners rotate before whoever built that precomputed table comes back for the rest.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.