Coinkite Coldcard Security Advisory
Mk2, Mk3 versions confirmed affected.
If you are using a Coldcard by Coinkite, read the official advisory before taking action and do not rush into a mistake that could also cost you Bitcoin.
Reports circulating earlier today said roughly 594 BTC across about 500 wallets had already been drained. Coinkite has since published an official seed-generation warning based on its initial forensics.
Read Coinkite’s official security advisory.
This appears to affect seed generation on Coldcard Mk3 devices, and possibly Mk2 devices, using firmware versions prior to 5.0.3.
If all of the following are true, you should carefully move your Bitcoin out of that wallet:
- You are using a Coldcard.
- You did not use at least 50 dice rolls for entropy.
- You did not set a BIP-39 passphrase.
- Your wallet is not multisig.
If you are using an Mk4 or Q1 and also did not use at least 50 dice rolls for entropy, moving funds is prudent there as well.
In other words: if you relied on the device-generated seed phrase without adding external entropy, caution is warranted.
Do not seed-sweep the wallet into a new wallet, because the problem is with seed generation itself.
Safer options include:
- Create a new wallet with a solid open-source desktop client such as Electrum or Sparrow, secure the funds, and then consider moving them again to a fresh air-gapped setup.
- Move funds to an existing unaffected wallet that was created somewhere other than the Coldcard device.
- Temporarily deposit to a trusted exchange account if you are already set up there and have strong security enabled, buying yourself time to plan the next step.
If you are not specifically affected as described above, keep monitoring the situation through the official Coinkite blog, the Bitcast replay, or Bitcoin Mentor if you want migration help.
Stay calm and do not fall for the inevitable scams that follow events like this, especially fake rescue emails or “secure your wallet” links.
mark
