Canadian Bitcoin hardware maker Coinkite has warned users of its Coldcard Mk3 signing device to move funds from wallets whose seed phrases were generated on affected firmware. On Thursday, Coinkite said seeds created on an Mk3 running firmware version 4.0.1, released in March 2021, or any later Mk3 version may put funds at risk. The issue extends through version 5.0.3, the final firmware supporting the Mk3, while the Mk4, Q and Mk5 are not affected, according to the company’s early analysis. The warning comes as Bitcoin security specialists examine an unexplained, coordinated sweep involving 594.48 $BTC from single-signature addresses. However, no definitive public evidence has established that the Mk3 issue caused those transfers. “Out of an abundance of caution,” Coinkite urged affected users to generate a new seed on an unaffected device, verify its backup and rece…

Coinkite said its early analysis indicates that affected seeds used with a BIP-39 passphrase face minimal risk, stressing that this refers to a passphrase rather than the Coldcard PIN. The sweep attracted attention after a Reddit user said funds had been drained from a wallet whose seed was generated on a Coldcard Mk3 bought in May 2021. The user said the seed was later restored onto a Coldcard Mk4 in January 2026, meaning it had subsequently been entered into a second device. The account is self-reported and does not establish a connection between Coldcard and the broader sweep. In a preliminary analysis posted on Friday, AnchorWatch CEO and co-founder Rob Hamilton said that 1,324 unspent transaction outputs were swept across 500 transactions within a three-block window, moving 594.48 $BTC. At the time of writing, the 594.48 $BTC was worth approximately $38.3 million…