Coldcard Mk3 Flaw Drains 594 BTC: What’s Next

The Coldcard Mk3 Bitcoin wallet security flaw that reportedly drained 594 BTC — worth roughly $38 million at current prices — in a single 25-minute sweep is one of those events that should stop every serious self-custody advocate cold. Not because hardware wallets are suddenly useless, but because this incident exposes exactly the kind of quiet, structural vulnerability that most holders never think to check until it’s too late.

594 BTC Gone in 25 Minutes: What We Know About the Drain

According to CoinDesk’s reporting, the funds were swept with startling efficiency — 594 BTC moved out of wallets in under half an hour. That kind of speed isn’t a smash-and-grab; it’s a coordinated drain, the kind you’d expect from an attacker who already knew exactly where the keys were and had time to script the transaction sequence in advance. The swiftness of it is, in some ways, the most damning detail.

What makes this different from a standard exchange hack or a phishing scheme is the hardware wallet dimension. The Coldcard Mk3 has long carried a reputation as one of the more battle-hardened Bitcoin signing devices on the market. Coinkite, the company behind it, has built its brand almost entirely on security credibility. So when Cointelegraph reported that Coinkite itself issued a warning urging Mk3 users to migrate their funds, the acknowledgment landed with particular weight. This wasn’t a third-party researcher crying wolf — it was the manufacturer telling you to move.

The specific concern centers on seed generation. Coinkite identified what they describe as a potential seed-generation risk in the Mk3 hardware. If the entropy used to generate your seed phrase was weaker or more predictable than it should have been — under certain conditions — an attacker with knowledge of that flaw could theoretically derive your private keys without ever physically touching your device. That’s the nightmare scenario for hardware wallet security: a flaw that defeats the entire model.

The Coldcard Mk3 Security Flaw: Seed Risk and What Coinkite Is Actually Saying

Coinkite’s official guidance, as The Block detailed, is pointed and practical: “create a strong, unique BIP-39 passphrase on the device and move funds to the resulting wallet.” That’s not a casual suggestion — that’s an emergency migration protocol dressed in polite corporate language.

The BIP-39 passphrase recommendation is significant here. A strong, unique passphrase effectively creates a completely different wallet derivation path, meaning even if an attacker could reconstruct your base seed, the passphrase-protected wallet would remain inaccessible. It’s a solid technical mitigation. But it also requires that you actually execute the migration correctly — move funds to the new passphrase-derived wallet, verify receipt, and stop using the old addresses entirely. One slip in that process and you’ve potentially exposed yourself during the transition window.

What’s still murky is whether the 594 BTC theft is directly and definitively linked to the Mk3 seed-generation vulnerability, or whether security experts are examining the two situations in parallel. Cointelegraph’s framing suggests the latter — that the drain is being investigated as a separate incident that may or may not trace back to this specific flaw. CoinDesk’s reporting treats them as connected. Until a forensic post-mortem is published, the honest answer is we don’t have full confirmation of the exploit chain. That uncertainty is uncomfortable, but pretending otherwise doesn’t help anyone.

Why the Mk3’s Legacy Status Made This Worse

The Mk3 is not Coinkite’s current flagship — that would be the Mk4 and the newer Q device. The Mk3 has been in users’ hands for years, and that’s precisely the problem. Long-term holders using older hardware wallets often fall into what I’d call the “set it and forget it” trap. You buy a hardware wallet, generate a seed, move your Bitcoin onto it, and then — because nothing bad has happened — you stop thinking about the device itself as an attack surface.

Security infrastructure ages. Firmware gets patched on newer models. Older hardware accumulates known-but-undisclosed vulnerabilities that researchers eventually surface, sometimes years later. The people who kept large balances on Mk3 devices without migrating to newer hardware were, in retrospect, running legacy infrastructure with institutional-scale exposure. That’s a risk management failure, and it’s a common one.

This is also why the speed of the drain matters so much analytically. If an attacker exploited a seed derivation weakness, they likely had access to the theoretical exploit for some time before acting. The 25-minute execution window suggests the reconnaissance and key derivation happened well before the actual transaction sweep — meaning whoever did this was patient and prepared.

Self-Custody Isn’t Dead — But Complacency Is Dangerous

I want to be careful not to let this become a “not your keys, not your coins” counter-narrative that pushes people back toward exchange custody. That would be the wrong lesson. Exchanges have their own catastrophic failure modes — see FTX if you need a reminder. The lesson here is more specific: self-custody requires active security hygiene, not passive faith in hardware.

If you hold any meaningful amount of Bitcoin, now is a reasonable time to audit your setup. What hardware are you running? When did you last verify your seed backup against your device? Are you using a passphrase? Is your firmware current? These aren’t paranoid questions — they’re basic maintenance that most holders skip. For those looking to stay informed on developments like this, our crypto news and market coverage tracks security developments alongside broader market analysis.

The $38 million figure is also a stark reminder of what’s actually at stake. At BTC’s current price around $64,200, 594 Bitcoin represents genuine generational wealth for many people. The sort of balance that warrants not just a hardware wallet, but a multi-signature setup, geographically distributed backups, and periodic security reviews. Single-device, single-seed storage at that scale is, frankly, under-engineered for the risk.

My Actual Take: What I’d Do Right Now If I Held Mk3

If you’re sitting on a Coldcard Mk3 with any balance you’d miss, I’d treat Coinkite’s warning as a hard deadline, not a soft recommendation. Generate a strong BIP-39 passphrase — genuinely random, at least 12 characters mixing symbols and cases, not your dog’s name with a number at the end — on the Mk3 itself, derive the new wallet, sweep your funds there, and then start planning an upgrade to a Mk4 or a comparable current-generation device. Don’t move the bulk of your funds back to an exchange during the transition; that just trades one risk for another.

For anyone evaluating where to hold or trade Bitcoin in the meantime, it’s worth reviewing current exchange referral offers from reputable platforms — fee discounts add up during volatile periods, and established exchanges have hardened custody infrastructure for assets you’re actively trading rather than cold-storing.

The broader signal I’m taking from this: the self-custody ecosystem needs better tooling around hardware lifecycle management. Nobody sends you an alert when your cold wallet’s security model has aged out. That gap is where incidents like this live. Until the industry solves it, the responsibility sits entirely with the holder — and that means staying actively informed, not just physically holding keys.