Flaw Exposes Years-Old Dormant Wallets
A critical vulnerability in the Coldcard Mk3 hardware wallet has resulted in one of the largest single-event Bitcoin thefts to date, with approximately $38 million in BTC drained from nearly 500 wallets within just 25 minutes. The attack, which took place between 01:31 and 01:56 UTC on Friday, targeted wallets whose private keys were generated using affected firmware versions dating back to March 2021.
Many of the compromised wallets had been dormant for years—some since as early as 2021—underscoring how long the flaw went unnoticed. In total, attackers swept 594 bitcoin from single-signature addresses, moving funds that spanned a five-year window from 2021 through projected activity in 2026. The breach highlights that even coins left untouched for long periods remain at risk if underlying key generation is flawed.
Block traced the key generation issue to a software commit on March 1, 2021, which was included in firmware 4.0.0 for the Mk3 model.
$38M Vanishes in 25-Minute Heist
The heist itself was executed with remarkable speed and coordination. Over a three-block window on the Bitcoin blockchain, thieves moved 1,324 chunks of bitcoin across roughly 500 transactions, consolidating 562 BTC into a single address that has not yet shown further movement. Each affected wallet held more than 0.15 BTC—at current prices, that's over $9,500 per wallet swept.
On paper, hardware wallets like Coldcard are designed to offer robust protection against online attacks. In practice, a subtle software oversight left hundreds exposed. According to coindesk.com, the flaw originated from a software fallback inherited from MicroPython during a migration in March 2021 and shipped in firmware version 4.0.0 for the Mk3 model.
It’s unclear whether the attacker used artificial intelligence or brute force to exploit the reduced randomness in key generation.
Firmware Bug Tied to Single-Sig Losses
The vulnerability specifically impacted single-signature wallets—those controlled by one private key rather than requiring multiple parties to authorize transactions. All affected addresses lacked multi-signature protection and had their seeds generated on Coldcard Mk3 devices running firmware versions from 4.0.1 up to and including 5.0.3. Coinkite's initial analysis confirmed that newer models such as Mk4, Q, and Mk5 are not affected by this bug.
The root cause was a drastic reduction in entropy—the randomness used to create wallet seeds—which shrank the effective search space from an intended 128 bits down to about 40 bits. This made it vastly easier for attackers to recreate private keys and sweep funds without detection until it was too late.
Coinkite Rushes to Contain Fallout
Following discovery of the exploit, Coinkite issued urgent advisories for users of Coldcard Mk3 devices who generated seeds on affected firmware versions after March 2021. Owners were instructed to immediately move their funds to new wallets created with patched hardware; simply updating device firmware does not secure previously generated seeds.
Emergency hotfixes were released for unaffected models—version 5.6.0 for Mk4 and Mk5 units and version 1.5.0Q for Q devices—to ensure no similar vulnerabilities exist elsewhere in the product line. Notably, related products like Tapsigner, Opendime, and Satscard use different code bases and were confirmed as unaffected by this specific flaw.
Bitcoin’s price reflected modest turbulence following news of the theft, slipping about 1% over the past day to $63,900 while Ether also declined by nearly 1.7% to $1,884.
Security Lapse Rocks Hardware Trust
The scale and speed of this incident have rattled confidence among hardware wallet users and industry veterans alike. AnchorWatch CEO Rob Hamilton reported that all compromised addresses were single-signature—a setup often chosen for simplicity but now revealed as vulnerable under certain firmware conditions.
While Coinkite clarified that seeds protected with a BIP-39 passphrase face minimal risk (distinct from device PINs), most affected users appear not to have enabled this extra layer of security. As a result, hundreds lost access to significant sums—some likely unaware until checking balances days later.
Broader market movements on Friday added contrast: while Apple shares fell by 8% post-earnings and Amazon surged over 11%, Bitcoin’s dip was relatively minor given the magnitude of stolen funds.
Short-term watchlist
If additional movements are detected from the address consolidating 562 BTC stolen during the 25-minute sweep between 01:31 and 01:56 UTC on Friday, it would immediately confirm that the attacker is beginning to launder or disperse the stolen funds; as of now, those coins have not moved further.