Coldcard maker Coinkite is urging users to move bitcoin from wallets created on affected firmware while an exploit continues to drain exposed funds. A revised Galaxy estimate put cumulative losses as high as $114 million, including a possible fourth sweep that moved roughly 449 BTC from 709 addresses.
The problem sits in seed generation, the step where a hardware wallet creates the secret that controls its bitcoin. Coinkite's security advisory says affected firmware could produce seeds with weaker device-generated randomness than expected. An attacker who reconstructs a seed can control the funds without touching the physical device.
Coinkite's current security status page lists Mk4 and Mk5 standard firmware 5.6.1 and Q firmware 1.5.1Q as the recommended releases. It says new-seed generation now requires user-supplied entropy, and that the devices add checks around PSBT signing, USB data handling, firmware files, random-number generation and backups. Those controls affect future seed creation and device operation; they do not repair an existing affected seed.
A current CoinDesk report and a Decrypt report put the reported losses at roughly $130 million and described the same firmware response. The public public downloads page and status page should be checked directly before installing. Users with seeds created on affected firmware still need to follow the migration instructions.
Who needs to act
The advisory covers Mk2 and Mk3 devices running firmware 4.0.1 through 4.1.9, and seeds created on Mk4, Mk5 and Q devices before their fixed releases. It gives a separate exception for seeds made with at least 50 fair, independent and private dice rolls, subject to the conditions in the notice. Users who cannot confirm their seed's history are told to treat it as exposed.
Coinkite's current download page lists fixed releases for the affected model tracks, while its migration guide says the sequence is deliberate: install the fix, create a new seed, verify the backup and receive address, send a small test transaction, then move the remaining funds. The old backup should be kept until the transfer is complete and confirmed.
The incident has a narrow technical cause in the seed-generation code. The practical dividing line is whether a wallet's seed was created through the affected path. Coinkite says its investigation is continuing and plans to publish more technical detail.
