Coldcard Mk3 bug drained $70M in Bitcoin from 1,200 wallets

Coinkite, the Toronto-based maker of Coldcard, released a patched firmware version 4.2.0 and above. The company said updating firmware alone does not fix the problem. Users who created wallets with compromised seeds must generate new seeds on patched hardware and move their funds to new addresses. The newer Mk4, Q, and Mk5 models were not affected.

Changpeng Zhao, the Binance founder, advised users to split their funds across multiple wallets. He also noted the trade-off: more wallets mean more seed phrases to manage and more room for error.

For retail holders who set up Mk3 devices during the 2021 bull run and have not touched them since, the first step is checking which firmware version their device ran at wallet creation. Coinkite's advisory lists the affected build range. If the wallet falls in that window, moving funds to a fresh address on patched hardware is urgent.

The 1,082 BTC haul, worth roughly $70 million at the time of the attack, is one of the largest hardware wallet exploits on record. The attackers specifically hit long-dormant addresses, indicating they had time to map vulnerable seeds before the sweep.