Coldcard Mk3 Flaw Drains 594 BTC From Hardware Wallets

Hardware wallet maker Coinkite has issued a warning about the Coldcard Mk3. A firmware bug let an attacker drain 594 BTC, about $38 million, in under half an hour. The company believes the attacker used artificial intelligence to find the flaw in its open-source code, even though its own review with a similar tool weeks earlier turned up nothing suspicious.

What happened to the Coldcard wallets?

Coinkite published the advisory on Thursday, and the attack itself was spotted early Friday morning. According to the company, roughly 500 wallets lost 594 BTC within 25 minutes, and the attacker consolidated 562 of those coins into a single address. The victims were owners who had generated a key on the device after it shipped with firmware 4.0.1 or later.

The losses belong to people who trusted a hardware wallet to store their Bitcoin precisely because they expected reliable key generation. That trust turned out to be misplaced.

How did the flaw actually happen?

The firmware carried two functions built for the same purpose. One was the hardware generator Coinkite wrote itself. The other was a software fallback inherited from MicroPython. A build check only looked at whether a setting was defined, not what its value was, so the build passed quietly against the fallback. Key generation had run this way since a migration back in March 2021.

• Duplicate function: the hardware and software generators shared identical signatures in the code
• The safety check tested whether a flag existed, not its actual value
• The bug sat unnoticed for more than four years, since March 2021
• Effective entropy on the Mk3 dropped to roughly 40 bits instead of the intended 128

By comparison, the Mk4, Q and Mk5 draw extra entropy from secure elements inside the device, which lifts their figure to about 72 bits. That is better, but still short of the 128-bit target.

Why did AI end up on both sides of this?

Coinkite says it ran one of the best available models over its own code a few weeks before the attack and got no serious warning back. After the breach, the team had to admit that someone else likely combed through the open-source version history the same way and found what its own model had missed.

"Attackers and defenders have the same tools. This time, it did not help us, and only helped the bad guys."

- Coinkite, from its technical writeup of the vulnerability, July 30, 2026

Can code audits still be trusted once the same tool is available to attackers and defenders alike? Coinkite offers no clean answer. It only admits that this time the tool worked against it.

What should wallet owners do?

Coinkite has already shipped an emergency hotfix, version 5.6.0 for the Mk4 and Mk5 and 1.5.0Q for the Q. Updating the firmware alone does not repair a seed that was already generated. Owners need a fresh seed created on patched hardware, and the company recommends adding a strong BIP-39 passphrase, at least 99 dice rolls, or both for extra entropy.

The Mk3 is out of support, so it gets a separate migration path. A weak seed stays weak even after it is restored onto another maker's device. Rival hardware wallet maker Trezor made exactly that point while reassuring its own customers that their wallets were not affected.

What does this mean for the hardware wallet market?

Block, maker of the Bitkey wallet, published its own independent analysis and said none of its products carry the flaw. The company's hardware lead publicly urged any exposed users to move their funds as soon as they safely could.

The Coldcard episode is a reminder that the reliability of hardware wallets depends on more than the physical chip inside them. It also depends on a line of code nobody read closely enough in time. Crypto owners should check which firmware generated their key and avoid leaning on a single code review, even one run by artificial intelligence.