Canadian hardware wallet maker Coinkite issued a security advisory on July 30, 2026, warning owners of its Coldcard Mk3 device that seeds generated on firmware versions 4.0.1 through 5.0.3 may be compromised by a possible random number generator flaw. The advisory covers the entire supported firmware lifespan of the Mk3, from the March 2021 release of 4.0.1 to the final 5.0.3 build. Coinkite's early analysis indicates the newer Mk4, Q, and Mk5 models are not affected.
The warning coincided with an unusual on-chain event. Roughly 594.48 BTC, valued at approximately $38.3 million at a Bitcoin price of $64,364, moved from about 500 single-signature addresses within a three-block window. AnchorWatch CEO Rob Hamilton identified 1,324 unspent transaction outputs swept across those addresses, many of which had been dormant since 2021 with balances typically between 0.15 and 0.26 BTC. The coordinated timing drew immediate scrutiny from security researchers.