Coldcard Security Scare Puts Hardware Wallet Industry Under Pressure After 594 BTC Drain

Hardware wallet maker Coinkite has warned some users of its Coldcard Mk3 devices that their bitcoin may be at risk after 594.5 BTC worth around $38 million was drained from 500 wallet addresses. The advisory put the hardware wallet industry under fresh scrutiny, with analysts predicting larger inflows into BlackRock’s IBIT ETF amid the security concerns

Security warning follows coordinated Bitcoin drain

The advisory came after a blockchain researcher reported a coordinated series of transactions that swept 594.5 BTC from 500 single-signature Bitcoin addresses. At the time of the transfers, the stolen funds were worth about $38.3 million.

“Out of an abundance of caution, Coinkite is warning all users who generated a seed using a Mk3 on version 4.0.1 (March 2021) or any subsequent version that their funds may be at risk,” read the warning.

While Coinkite has not confirmed that the theft resulted from the issue identified in its advisory, several blockchain experts have linked the drained wallets to seeds generated on affected Coldcard Mk3 devices.

Bitcoin developer James O’Beirne urged users who secured funds with a single key generated on a Coldcard Mk3 between 2021 and 2023, without additional protections like dice-generated entropy or multisignature security, to move their bitcoin immediately. Although Coinkite’s early analysis excluded Mk2 and Mk4 devices, O’Beirne said those models could also warrant further investigation.

Meanwhile, Coinkite recommended that users with potentially affected Coldcard Mk3 devices create a strong, unique BIP-39 passphrase before transferring funds to the resulting wallet. 

“When migrating to a new key, calm and care should be applied,” said Coinkite. “Rushing a wallet migration can create a more immediate risk than the issue you are trying to address.

Self-custody faces renewed scrutiny

While self-custody is considered the safest way to store digital assets, the latest incident has ignited debate in Bitcoin circles. Pundits are debating whether retail investors are better served by managing their own keys or gaining Bitcoin exposure through regulated investment products.

“The self-custody industry will never recover from this,” said pseudonymous X user Zynx. “BlackRock’s IBIT is about to get even more popular.”

Spot Bitcoin ETFs like BlackRock’s IBIT eliminate the need for seed phrases and hardware devices by relying on professional custodians to safeguard the underlying Bitcoin. While Bitcoin ETFs are set to record their lowest net monthly inflow, experts are predicting a surge in inflows before July comes to a close.

Meanwhile, hardware wallet makers Trezor and Foundation have reassured users that their funds are safe and secure despite the Coldcard scare. However, on-chain investigator ZachXBT branded hardware wallets as “garbage,” urging holders to use a dedicated iPhone to store their digital assets.