Canadian hardware wallet vendor Coinkite has issued an urgent security advisory for its Coldcard Mk3 signing device, warning users to move funds away from wallets whose seed phrases were generated on certain Mk3 firmware versions. The company says the issue affects Mk3 firmware 4.0.1 through 5.0.3, and that affected seeds may put funds at risk.

The warning arrives as Bitcoin investigators and security specialists scrutinize an unrelated-looking but highly unusual sweep of 594.48 BTC from single-signature addresses. While commentators have connected the timing to Mk3 devices, Coinkite stresses that no definitive public proof has linked its firmware warning to the broader sweep.

Key takeaways

• Coinkite’s advisory targets Coldcard Mk3 firmware versions 4.0.1 to 5.0.3; Mk4, Q, and Mk5 are stated as not affected.
• The recommended response is to generate a fresh seed on an unaffected device, verify backups and receiving addresses, then send test transactions before moving remaining funds.
• Early internal analysis from Coinkite indicates BIP-39 passphrases (distinct from the device PIN) may face minimal risk.
• Security experts are analyzing a separate event: a sweep of 594.48 BTC across 500 transactions within a narrow three-block window from single-signature addresses.

Coinkite flags an Mk3 firmware window

In a post on its official blog, Coinkite said that seeds created on a Coldcard Mk3 running firmware version 4.0.1 (released in March 2021) or any later Mk3 firmware may expose funds to risk. The company extends the affected range through firmware version 5.0.3, described as the final firmware supporting the Mk3.

Coinkite’s early analysis also draws a boundary around which components of wallet setup are most relevant. It said seeds used with a BIP-39 passphrase face minimal risk, while clarifying that this refers to a passphrase rather than the Coldcard PIN.

Importantly, the company framed its guidance as a precautionary measure. “Out of an abundance of caution,” Coinkite urged users with potentially affected seeds to generate a new seed on an unaffected device, confirm the backup, verify the receiving address, send a small test transaction, and only then transfer the rest of their funds. Coinkite added that its investigation is still ongoing and that it will deliver a formal technical review.

What triggered renewed attention: the 594.48 BTC sweep

Interest in this broader incident intensified after a Reddit user reported that a wallet drained from an account associated with a Coldcard Mk3 purchased in May 2021 had later been restored onto a Coldcard Mk4 in January 2026. That user’s account is self-reported and does not, by itself, establish a direct connection between the Mk3 firmware warning and the sweep activity.

Separately, AnchorWatch CEO and co-founder Rob Hamilton published a preliminary analysis stating that 1,324 unspent transaction outputs were swept across 500 transactions in a three-block window, moving a total of 594.48 BTC. In his write-up, Hamilton noted that all affected addresses were single-signature, and that 562 BTC was later consolidated into another address.

Hamilton described the pattern as consistent with “flawed entropy in wallet generation somewhere along the way,” echoing the possibility that randomness quality during seed creation may have mattered. At the time of writing, the 594.48 BTC was estimated to be worth about $38.3 million based on Bitcoin’s price of $64,364.07, according to CoinGecko.

Experts debate cause: low-entropy seeds and partial drainage

Another security researcher, Wizardsardine CEO Kevin Loaec, offered a hypothesis focused on the randomness source itself rather than the sweep mechanics. In a separate post, Loaec said his current theory is that a low-entropy random-number generator—potentially located in a software library, a secure element, or a specific device batch or firmware version—produced wallet seeds with insufficient randomness.

Loaec further suggested that if attackers were aware of the flaw, they may have used an AI-generated brute-force script. In his account, the search was confined to a limited set of BIP-84 derivation paths, which could help explain why the sweep appears concentrated in native SegWit addresses and why some wallets were only partially drained. He emphasized that the idea remains unconfirmed.

Crucially, Loaec warned that if his model is correct, wallets that saw only partial drainage could remain vulnerable to additional attempts. He also said funds in other address types might be exposed if the attacker expands scanning beyond the initially targeted formats.

Why the guidance matters for users—especially in light of the speculation

Even though Coinkite has not publicly connected the Coldcard Mk3 firmware issue to the 594.48 BTC sweep, the overlap in themes—seed quality, single-signature theft, and concentrated sweep behavior—means the advisory should be treated as a direct action item. Hardware-wallet incidents differ from typical “compromised computer” narratives: if the weakness is in seed generation, reusing the same seed (even on a different device) can keep exposure alive.

That’s why Coinkite’s recommended operational steps are specific and defensive: creating a new seed on an unaffected device, validating backups, confirming the correct receiving address, and using a small test transfer before moving the remainder. This sequence is aimed at reducing the risk of both theft and user error during migration—two failure modes that often show up around recovery events.

For users, the key uncertainty is whether the sweep investigators will eventually find deterministic evidence linking the Mk3 firmware range to the stolen outputs. Until then, Coinkite’s advisory stands independently as a risk-management decision for any Coldcard Mk3 owner who created seeds during the stated firmware window.

Going forward, readers should watch for Coinkite’s promised formal technical review and for any public forensic work that either corroborates or rules out a relationship between the Mk3 seed-generation warning and the 594.48 BTC sweep pattern described by security specialists.

The American Arbitration Association launched a specialist Web3 Panel on July 29, creating a roster of arbitrators for disputes involving blockchain systems, smart contracts, digital assets, tokenization and autonomous transactions.

The New York-based organization said the panel is intended for commercial conflicts that combine familiar contract questions with technical evidence and cross-border activity. The official AAA announcement said the organization will continue recruiting specialists as the panel expands.

The launch does not establish a regulator or court. Instead, it adds specialists to the AAA’s existing arbitration and mediation system. Parties must still have an arbitration agreement, or agree after a dispute arises, before the organization can administer a case.

AAA Web3 panel covers code, custody and governance disputes

The AAA said the panel may hear disagreements over contract formation, governance, asset control, cybersecurity, transaction records and cross-border enforcement. Its dedicated Web3 dispute-resolution page also lists smart-contract bugs, exchange restrictions, wallet custody, stolen-asset recovery, DAO voting and tokenized-asset rights.

The scope extends beyond cryptocurrency. Agentic commerce and autonomous transactions are included because software or artificial intelligence systems may negotiate, authorize or execute agreements with limited human involvement.

Eric Dill, the AAA’s head of panel relations, said “Web3 disputes involve familiar commercial questions in a highly technical environment.” That statement describes the organization’s reasoning for creating the panel. It does not establish a new legal standard.

In related coverage, a smart contract explainer described these systems as automated blockchain code rather than legal documents. Code can execute transactions, but it cannot interpret intent or independently enforce real-world remedies.

Five initial members combine legal and technical experience

The initial roster includes Kabir Duggal of Akin Gump, technology disputes lawyer David Evans and University of Pennsylvania law professor David Hoffman. Nelson Mullins partner Paula Pendley and Google Cloud Web3 strategy head Rich Widmann also joined the panel.

Their stated experience covers international arbitration, automated commerce, decentralized finance, Bitcoin mining, artificial intelligence infrastructure and digital-asset businesses.

The AAA said it is continuing to recruit arbitrators as new technologies and business models produce additional disputes. However, it did not announce a fixed panel size, a first assigned case or a timetable for expansion.

Therefore, the launch establishes an available specialist roster rather than a mandatory forum for the crypto industry. Companies and customers will still need a valid contractual basis to bring disputes before the AAA.

Existing arbitration rules will still govern cases

Business-to-business technology disputes will generally proceed under the AAA’s Commercial Arbitration Rules. Disputes between consumers and exchanges, wallet providers or other businesses will usually use its Consumer Arbitration Rules.

A claimant must submit an arbitration demand, describe the claim, provide the relevant arbitration clause and pay the applicable filing fee. The panel itself does not gain enforcement or supervisory authority over exchanges, protocols or token issuers.

Under Section 2 of the Federal Arbitration Act, written agreements to arbitrate commerce-related disputes are generally enforceable, subject to legal grounds that may invalidate other contracts. Courts may still become involved when parties contest whether they agreed to arbitrate or seek enforcement of an award.

That distinction has already mattered in crypto cases. As previously reported, the U.S. Supreme Court ruled against Coinbase in a Dogecoin sweepstakes dispute, finding that a court had to decide which of two conflicting contracts controlled.

What happens next for the AAA Web3 panel

Companies seeking access to the panel can add an AAA arbitration clause to commercial agreements. They can also submit an existing dispute when their contract already names the AAA or its rules.

The organization says blockchain transactions are generally not reversed by arbitration itself. Instead, an award or settlement may require repayment, a new asset transfer or another remedy conducted outside the original transaction.

The AAA plans to expand the roster as disputes develop around automated systems, tokenization and AI-driven transactions. As of July 30, its public announcement did not disclose pending case volumes, expected Web3-specific fees or a deadline for adding new members.

The panel arrives as arbitration is already being used in major digital-asset disputes. Kraken secured a $22 million arbitration award against former auditor Mazars USA before seeking court confirmation of the decision.

The Ethereum Foundation appointed Pascal Caversaccio, known as pcaversaccio, to its board on July 29 for an initial one-year voluntary term.

The move expands the governing body to four members as the organization places greater weight on privacy, security and censorship resistance.

Caversaccio joins Ethereum co-founder Vitalik Buterin, Foundation President Aya Miyaguchi and Swiss counsel Patrick Storchenegger. The official board update described him as a longtime Ethereum contributor, a co-founder and lead of SEAL 911, and a member of the Foundation’s Silviculture Society.

Ethereum Foundation adds a security specialist

The Ethereum Foundation said its board sets the organization’s vision and checks whether management’s strategies remain aligned with its values. It also described the body as a “security council” that protects the Foundation’s mission and ensures compliance as a Swiss foundation. That wording reflects the Foundation’s governance model rather than a separate regulatory status.

Caversaccio’s background combines technical security work and privacy advocacy. He wrote The Ethereum Cypherpunk Manifesto in 2024 and Ethereum Privacy: The Road to Self-Sovereignty in 2025. The Foundation also credited him with advancing security practices through technical contributions and community work.

Privacy and security shape the new structure

The appointment follows the Ethereum Foundation’s June reorganization, which reduced its workforce by 54 people, or roughly 20%. The new structure divided work across protocol, access, user, community and institutional layers, alongside operations and management teams.

Within that structure, the protocol cluster treats privacy and security as “non-negotiable protocol guarantees.” Its stated work includes layer-1 privacy, post-quantum security, safer protocol upgrades, reduced technical complexity and defences against harmful maximum extractable value practices.

However, the Foundation’s formal mandate places privacy and censorship resistance at the centre of its work. The mandate does not give the Foundation control over Ethereum. Instead, it describes the organization as one steward among many across the network.

SEAL 911 adds incident-response experience

SEAL 911 is a free, around-the-clock emergency service for active or imminent crypto security incidents. Security Alliance says the initiative has handled more than 3,300 tickets, coordinated over 125 war rooms and helped rescue more than $180 million in assets.

That operational background gives Caversaccio experience with exploits, compromised wallets, protocol failures and fund-recovery efforts. However, the Foundation did not announce any new security programme, budget or incident-response authority tied directly to his appointment.

The two organizations already have a working relationship. The Ethereum Foundation sponsored a SEAL security engineer in February to track and counter crypto drainers targeting Ethereum users.

In related coverage, the Foundation explained how its protocol security team uses coordinated artificial-intelligence agents to identify and verify software flaws. The team reported finding a remotely triggered libp2p flaw that was fixed and disclosed as CVE-2026-34219.

What happens during the one-year term

The board update did not specify committee assignments, voting powers beyond normal board duties or measurable targets for Caversaccio’s first year. It also did not announce compensation, stating only that the role is voluntary and begins with an initial one-year term.

His main formal responsibility will therefore remain board-level oversight. Management will continue to handle execution, while the board reviews whether major strategies and decisions fit the Foundation’s mandate and Swiss legal obligations.

The appointment may place more security and privacy expertise inside those reviews, but the Foundation did not promise specific protocol changes. Work on layer-1 privacy, post-quantum protection and safer transactions will still move through researchers, developers and Ethereum’s broader governance process.

The Foundation has not announced an exact end date for the term or whether Caversaccio may be reappointed. Any continuation beyond the initial year would require a later board decision or public update.

Japanese game developer Gumi will begin operating a roughly ¥3 billion crypto asset fund with SBI Financial Services on Aug. 

According to a July 28 company announcement.The private fund, named SBI Crypto Fund I, will invest mainly in Bitcoin and major listed altcoins. Daiwa Securities Group and several unnamed investors have also committed capital. However, Gumi did not disclose individual investment amounts or the fund’s planned asset allocations.

Gumi and SBI will operate the fund for three years

SBI Crypto Fund I will operate as a private placement through a Japanese silent partnership structure. The fund has a planned three-year term and will be managed by SBI Crypto Fund LLC, according to the official fund overview.

SBI Financial Services owns 51% of the operating company. Gumi’s wholly owned subsidiary, gC Labs, owns the other 49%. The partners had originally considered beginning operations in 2025 but delayed the launch while assessing crypto-market conditions.

The fund will combine staking, portfolio rebalancing and hedging. Gumi did not identify the altcoins it plans to hold, its custody providers, fee structure or specific risk limits. It also warned that the announcement does not guarantee future returns and is not an invitation to invest.

Bitcoin and altcoins support a wider product strategy

Gumi said the fund’s mission is to “bridge the crypto asset market and Japanese companies” through investment and liquidity provision. That statement describes the fund’s planned role rather than a measurable outcome.

The participating companies also plan to collect performance data and test portfolio strategies that combine traditional and digital assets. Gumi said the information could support research into future investment trusts and other managed products. No such retail product has been announced or approved.

The company also said it wants to build a track record before the “possible lifting of the ban” on domestic crypto exchange-traded funds. Japan’s Financial Services Agency has discussed changes that could eventually allow certain crypto ETFs, but regulatory and investment-trust rules still need to support their launch.

Notably, Japan’s first Bitcoin ETF could arrive by 2028 as regulators revise the country’s fund framework. That date remains a reported possibility rather than an official launch deadline.

Gumi’s crypto assets nearly doubled within one year

Gumi’s crypto holdings have already become a large part of its balance sheet. The company reported ¥14.13 billion in crypto assets as of April 30, 2026, up from ¥7.58 billion one year earlier. The increase was about 86%.

Its annual financial results also showed a ¥2.63 billion valuation gain from crypto assets during the latest fiscal year. The company recorded a ¥60.4 million loss from crypto sales, while its operating profit fell to ¥83.3 million. Therefore, valuation gains made a large contribution to Gumi’s ¥2.17 billion ordinary profit.

Gumi said its crypto business centres on active holdings of XRP, portfolio management through Hinode Technologies and investment-fund operations.In addition, Gumi adopted XRP as a corporate treasury asset after previously approving a ¥1 billion Bitcoin purchase.

What happens after the August 1 launch

SBI Crypto Fund I is scheduled to begin operations on Aug. 1. The first verified information on its holdings, staking activity or performance will depend on future disclosures from Gumi, SBI or the fund operator.

The announcement did not set a reporting schedule or provide return targets. It also did not say whether investors may add capital after launch. For now, the confirmed structure remains a three-year private fund with approximately ¥3 billion in committed capital.

Crypto exchange Luno is cutting about 20% of its global workforce as part of a restructuring confirmed on July 28 by Chief Executive James Lanigan. 

The Digital Currency Group-owned company will reduce costs while directing more resources toward institutional customers and its business-to-business unit.

Lanigan did not disclose the number of employees affected or identify the regions and departments included. He said investments in automation and wider operational changes had altered the resources required to run the exchange.

Luno layoffs support an institutional shift

Luno plans to continue investing in compliance, core infrastructure and selected retail products while scaling services for other businesses. Its institutional platform offers liquidity and trading infrastructure for professional clients. The company’s website currently says it serves 15 million customers worldwide.

Lanigan said a “leaner and adapted structure is both necessary and appropriate.” That statement represents management’s assessment rather than a verified financial outcome. Luno has not published projected savings, restructuring charges or a completion date for the workforce reduction.

The latest cuts are smaller than Luno’s January 2023 retrenchment. At the time, the exchange officially announced a 35% reduction across all regions as the crypto downturn weakened growth and revenue. Contemporary reporting estimated that more than 330 roles were affected from a workforce of roughly 960.

July crypto layoffs reached at least 12 companies

The CryptoJobsList tracker listed 12 crypto or crypto-adjacent companies with July-dated cuts or restructurings. They included Luno, Gnosis, Uphold, BitMart, Dango, Odos, BitMEX, Exodus, Polygon Labs, AscendEX, Zapper and Yield Guild Games.

Adding the published figures for six of those companies gives 894 affected jobs. The tracker listed 550 at BitMart, 160 at BitMEX, 85 at Uphold, 54 at Exodus, 35 at Yield Guild Games and 10 at Odos. However, the figure remains incomplete because Luno, Gnosis and several other companies did not disclose exact totals.

CryptoJobsList recorded more than 7,254 disclosed cuts across 47 companies during 2026 and identified market conditions as the most frequently cited reason. However, the tracker relies on public announcements and media reports. It also includes fintech and crypto-adjacent businesses, making it a broad indicator rather than an audited industry total.

Gnosis also confirmed workforce reductions in its second-quarter report, published on July 17. Co-founder Friederike Ernst said the organization had reduced the Gnosis App team after deciding that “growth has been linear, and linear is not good enough” for a consumer product.

The organization plans to remove Gnosis App from Gnosis Ltd during the third quarter. A smaller team is expected to seek decentralized autonomous organization funding for an independent company. The proposal’s outcome and final staffing level remain unconfirmed.

Gnosis reported that the app had about 800 active card users in the second quarter, up from roughly 500 in the first quarter. Daily and weekly active users also increased. Still, management said the product required a smaller structure and faster decision-making outside the wider Gnosis organization.

Automation and payments reshape crypto staffing

The July reductions follow several firms that linked workforce changes to new business priorities. BitGo cut nearly 15% of its workforce in June while focusing resources on security, stablecoins, settlement and artificial-intelligence infrastructure.

Additionaly, Exodus cut 25% of its workforce while integrating Monavate and Baanx into a stablecoin payments and card platform. Its SEC filing said about 77 employees and individual service providers would be affected, with projected annual cash savings of $10 million to $13 million.

Luno has not announced comparable savings targets. The next verified updates may come through company statements, employee consultation processes or changes to its institutional services. Until then, the 20% figure remains the clearest measure of the restructuring, while the absolute number of affected workers remains unknown.

The U.S. Treasury sanctioned two Iranian maritime insurance companies on July 29, alleging that they supported an Islamic Revolutionary Guard Corps-linked system for collecting revenue from vessels using the Strait of Hormuz.

The Office of Foreign Assets Control added HormuzSafe Marine Services Authority and Persian Gulf Marine Insurance Company to its Specially Designated Nationals list. Both were designated under Executive Order 13902 for operating in Iran’s financial sector.

U.S. sanctions target HormuzSafe’s alleged Bitcoin use

Treasury described the two companies as part of an “IRGC-backed extortion scheme” that required commercial vessels to purchase approved maritime insurance before crossing the strait. These are U.S. government allegations, and the sanctions announcement did not include a court ruling against either company.

The department said HormuzSafe was developed by Iran’s Ministry of Economy and “accepts payment in Bitcoin and other digital assets” to bypass Western restrictions. It further alleged that the company generated revenue for the IRGC and helped Iran tighten control over regional shipping.

However, the public Treasury release and OFAC listing did not identify Bitcoin addresses, transaction hashes, payment amounts or specific customers. Therefore, the announcement confirms the U.S. designation and its allegations, but it does not provide public on-chain evidence showing completed Bitcoin payments.

Earlier Bitcoin insurance reports lacked payment evidence

moreover, HormuzSafe promoted maritime insurance payable in Bitcoin in May. The platform reportedly offered digital insurance policies and financial-responsibility certificates for ships operating around the Strait of Hormuz.

Iranian state-linked reports claimed the platform could eventually generate more than $10 billion annually. However, that figure was a projection rather than recorded revenue. No independent adoption data or verified Bitcoin payment records were available at the time.

The July action moves HormuzSafe from a reported sanctions-evasion proposal to an official U.S. sanctions target. Still, the designation does not establish how much cryptocurrency the platform received or whether Bitcoin formed a major part of its revenue.

Eight tankers and eight shipping firms were also targeted

OFAC also sanctioned eight companies accused of operating in Iran’s petroleum sector. The businesses are registered in China, Hong Kong and the Marshall Islands and were linked to vessels that Treasury said transported Iranian crude oil or petroleum products.

Eight tankers were identified as blocked property, including Well Sail, Lily, Al Salmi, Breeze V, Natsumi, Crystal, Nireta and Yehope. Treasury said some had carried millions of barrels of Iranian oil to China since 2022.

The Strait of Hormuz remains a central energy shipping route. U.S. Energy Information Administration data showed that flows through the waterway represented more than one-quarter of global seaborne oil trade and about one-fifth of worldwide oil consumption during 2024 and early 2025.

What happens after the OFAC designation

Property belonging to the sanctioned companies that enters U.S. jurisdiction must be blocked and reported to OFAC. Companies owned at least 50% by one or more blocked parties are also subject to restrictions, even when they are not separately listed.

U.S. persons are generally prohibited from providing funds, services or other economic benefits to the designated companies. Non-U.S. financial institutions may also face sanctions exposure when they knowingly facilitate certain transactions involving blocked parties.

The action did not announce a cryptocurrency seizure, criminal charge or enforcement case against customers who may have used HormuzSafe. Any later asset recovery or prosecution would require additional legal or regulatory action.

U.S. authorities previously froze $344 million in Iran-linked USDT across two Tron addresses. Unlike Bitcoin, USDT can be frozen through controls operated by its centralized issuer.

Visa Chief Executive Ryan McInerney said the payments company will remain neutral among stablecoins as Open USD prepares to enter a market led by Tether’s USDT and Circle’s USDC.

During Visa’s July 28 fiscal third-quarter earnings call, McInerney said the company would remain “multi-coin, multi-chain” and that its role was “not to pick winners.” Instead, Visa plans to help clients connect securely to whichever stablecoins, networks and infrastructure gain adoption.

Visa separates Open USD support from a single-token bet

Visa is one of more than 140 companies supporting Open Standard, the independent consortium developing Open USD. Other participants include Mastercard, Stripe, Coinbase, BlackRock, BNY, Google and several global banks.

However, McInerney’s comments show that Visa does not view its involvement as an exclusive commitment to OUSD. The company already supports several stablecoins and blockchains through settlement, card and money-movement products. Visa previously described its technical approach as a “multi-coin and multi-chain foundation.”

ARK Invest researcher Lorenzo Valente interpreted the response as evidence that partner support may be “closer to a soft LOI than a strategic bet.” That is an analyst’s view, not a disclosed Visa contract term. Neither Visa nor Open Standard has published commitments showing how much capital, distribution or balance-sheet support each partner must provide.

Open Standard plans to launch Open USD later in 2026. Its website says businesses will be able to mint and redeem OUSD without fees or volume limits, while most revenue from the reserves will return to participants that adopt and distribute the token.

That model differs from the issuer-led structures used by USDT and USDC, where the issuing company controls reserve management and related economics. Open Standard says an independent management team and partner-led governance will oversee OUSD. These are planned product features, and the token has not yet launched.

Notably, Open USD’s launch raised questions about Circle’s reserve-income model. Circle shares fell 17.5% on June 30, although Russell index removals also contributed to that day’s decline, making it difficult to isolate OUSD’s effect.

Visa is building infrastructure across stablecoins

Visa’s practical commitment is clearer in its own product releases. On July 16, the company introduced the Visa Stablecoin Platform for banks, fintechs and crypto companies. The platform initially provides access to Open USD, including minting, burning, storage and transfers through a Visa-managed environment.

The company said the platform will also connect with its existing stablecoin settlement, linked-card and money-movement services. In June, Visa reported that its stablecoin settlement activity had reached an annualized run rate of about $7 billion as of March 2026.

Additionally, Visa’s stablecoin platform was described as a route for institutions to use Open USD without building every wallet, security and treasury function internally. Visa’s broader structure could also allow it to serve clients choosing USDC, USDT or another regulated token.

Open USD’s launch will test partner commitment

Open Standard has not announced an exact launch date, initial circulating supply or confirmed transaction volume. Because OUSD is not yet live, there is no verified on-chain activity or market capitalization to compare with USDT and USDC.

The next test will be whether partners integrate OUSD into real payment, settlement and trading products after launch. Visa has already built an initial access route through its platform, but McInerney’s comments indicate the company will continue supporting competing tokens and networks.

Therefore, Open USD may gain distribution through Visa without becoming Visa’s exclusive stablecoin. Adoption will depend on reserve arrangements, regulatory compliance, partner integrations and actual customer demand rather than the size of the consortium alone.

Canadian hardware wallet maker Coinkite has issued an urgent security warning for owners of its Coldcard Mk3 signing device, advising users to move funds away from wallets whose seed phrases were generated using specific affected firmware versions. The company said the risk applies to Mk3 firmware 4.0.1 (released in March 2021) through 5.0.3, the last firmware version that supports the Mk3—while its Mk4, Q, and Mk5 models are not affected, based on early analysis.

The alert arrives amid renewed scrutiny from Bitcoin security researchers investigating an unexplained, coordinated sweep of 594.48 BTC from single-signature addresses. Coinkite emphasized that, at this stage, there is no definitive public proof linking the Mk3 seed-generation issue to that activity, but the company is asking users to act “out of an abundance of caution.”

Key takeaways

• Coinkite warns Coldcard Mk3 users to migrate funds from wallets whose seeds were created on affected firmware versions 4.0.1 through 5.0.3.
• The issue does not appear to affect newer hardware models (Mk4, Q, Mk5), according to Coinkite’s early findings.
• Coinkite’s guidance focuses on safer recovery hygiene: generate a new seed on an unaffected device, verify backups and receive addresses, and test with a small transaction first.
• Security analysts are examining a 594.48 BTC sweep from single-signature addresses, but no public evidence currently ties it directly to the Mk3 firmware problem.
• Coinkite says seeds protected with a BIP-39 passphrase (distinct from the Coldcard PIN) show minimal risk in its preliminary assessment.

Coinkite’s Mk3 seed-generation warning

In a post on its official blog, Coinkite said seeds created on an Mk3 running firmware version 4.0.1 or later versions—up to 5.0.3—may put funds at risk. The company’s early analysis did not identify the same concern for Coldcard Mk4, Q, or Mk5 devices.

The company’s recommendation is practical and staged. Coinkite urged affected users to generate a new seed on a device considered unaffected, confirm that the backup is correct, and ensure they are using the intended receive address. Users should then send a small test transaction before transferring the remainder of the balance.

Coinkite also tried to clarify a point of confusion that often arises in hardware wallet security discussions: in its assessment, the “BIP-39 passphrase” is the relevant protection mechanism, and it should not be conflated with the Coldcard PIN.

From firmware versions to real-world user risk

The significance of Coinkite’s warning lies in how deterministically Bitcoin wallets derive addresses from seed phrases. If seed generation was compromised in a way that reduced randomness—or introduced patterns an attacker could exploit—then previously used addresses may become more guessable. Hardware wallets are designed specifically to make theft difficult precisely because the seed should be unpredictable, so any defect that affects entropy can have downstream consequences.

While the company did not provide technical details in the excerpted warning, it did set boundaries around what users need to check: not every Coldcard Mk3 seed is automatically suspect, but those created on the specified firmware range. For users who cannot confidently identify the exact firmware version used during seed generation, Coinkite’s steps imply a conservative approach: treat the wallet as potentially exposed and migrate funds accordingly.

That “caution first” posture is particularly important given the broader environment. Hardware wallet security incidents—even when the evidence remains circumstantial—tend to trigger defensive behavior from both users and threat researchers, because a stolen seed can sometimes lead to recurring attempts rather than a single breach.

Security researchers link context, not causation

Attention intensified after a Reddit user described a wallet drain they claimed involved a Coldcard Mk3 purchased in May 2021. According to the user’s account, the seed was later restored onto a Coldcard Mk4 in January 2026, meaning it was entered into a second device afterward. The information, however, is self-reported and does not, on its own, establish a direct connection between Coldcard hardware and a larger set of suspicious transactions.

Separately, AnchorWatch CEO and co-founder Rob Hamilton published a preliminary analysis claiming that 594.48 BTC was swept across 500 transactions over a three-block window. In that assessment, Hamilton noted that 1,324 unspent transaction outputs were involved and that the addresses appeared to be single-signature. He also stated that roughly 562 BTC was later consolidated into another address. Hamilton suggested the pattern “looks like there was flawed entropy in wallet generation somewhere along the way,” describing the event as consistent with randomness issues, though this remains an interpretation rather than proof.

At the time of the reporting, the 594.48 BTC was valued at approximately $38.3 million using a Bitcoin price of $64,364.07, according to CoinGecko.

Another researcher, Wizardsardine CEO Kevin Loaec, offered a hypothesis focused on how low-entropy seeds might be produced. In his view, a low-quality random-number generator—potentially from a software component, secure element behavior, device batch, or specific firmware—could have resulted in wallets with insufficient randomness. Loaec suggested an attacker with knowledge of the flaw might use an AI-generated script to brute-force affected wallets, while limiting the search to a narrower set of BIP-84 derivation paths. That would align with why the sweep appears concentrated in native SegWit addresses, and why some wallets may have been only partially drained. He stressed that this theory is still unconfirmed and that further scanning might expose additional holdings.

The key tension across these analyses is the difference between “consistent with a flaw” and “proven caused by this specific device.” Coinkite’s warning sits in the first category—credible internal assessment that certain Mk3 firmware versions may expose users—while the external sweep investigation remains a broader pattern that researchers are still trying to attribute.

What to watch next for affected users

If Coinkite’s risk assessment is accurate, the most important variable for users is whether their seed phrase originated from the affected firmware range and whether it was protected with a BIP-39 passphrase. The company’s preliminary statement that BIP-39 passphrase seeds face “minimal risk” provides some comfort, but it does not eliminate the need for verification and safe migration steps.

Going forward, readers should watch for Coinkite’s promised formal technical review and for further independent analysis that either strengthens or weakens the suspected link between the Mk3 seed-generation issue and the 594.48 BTC sweep. Until that picture is clarified, the prudent takeaway remains the same: treat potentially affected wallets as exposed, and move funds using newly generated seed material on unaffected hardware.

BitGo detailed four quantum-risk management controls for institutional Bitcoin wallets in a July 22 product announcement, aiming to measure and reduce public-key exposure before quantum attacks become practical.

The tools apply to supported Bitcoin multi-signature wallets. They include a Quantum Risk Score, a guided address-remediation workflow, a new UTXO selection method and updated default address controls. BitGo said the release supports operational preparation and does not replace any future Bitcoin protocol upgrade.

BitGo turns public-key exposure into a wallet metric

For common hashed-key Bitcoin outputs, spending reveals the public key needed to verify the transaction. If coins remain tied to that key through address reuse or a partial spend, they could become targets if a cryptographically relevant quantum computer eventually derives private keys from public keys.

Taproot requires a separate distinction. Its output key is visible when the output is created, rather than only after a later spend. The draft BIP 360 proposal also identifies Pay-to-Public-Key outputs, reused outputs and Taproot outputs as exposed to long-duration attacks under a future quantum scenario.

BitGo’s Quantum Risk Score gives clients an in-platform measure of exposure across supported wallets. However, the company has not published the score’s formula, weighting system or thresholds. It is therefore a company risk-management measure, not an independent Bitcoin security standard.

Four controls change how institutions handle UTXOs

The new UTXO selection method groups coins by address. When a wallet selects one UTXO from an address, it attempts to include every other UTXO associated with that address. The approach is intended to avoid leaving funds behind after a spend exposes the relevant public key.

The Fix Exposed Addresses workflow moves affected funds into newly generated addresses whose public keys have not appeared onchain. Updated defaults are also intended to reduce reliance on address types and transaction patterns that create earlier exposure.

BitGo said Taproot and Pay-to-Public-Key funds require separate remediation because those formats expose public-key information from creation. The company did not identify support for those remediation paths in the current product release.

BitGo quoted Blockstream co-founder Adam Back as saying “nobody has a quantum computer that can touch Bitcoin today.” That assessment means the product addresses a future risk rather than an active method of stealing Bitcoin. It also does not change Bitcoin’s signature system or protect the network by itself.

Bitcoin developers are separately discussing BIP 360, a draft soft-fork proposal for Pay-to-Merkle-Root outputs. The design removes Taproot’s key-path spend and aims to reduce long-exposure attacks. However, its authors say faster attacks against keys revealed while transactions await confirmation may require post-quantum signatures.

BIP 360 remains a draft and has not been activated on Bitcoin. Any network-wide change would still need technical review, implementation, testing and broad adoption across wallets, nodes and other infrastructure.

Onchain data explains the institutional focus

Glassnode estimated in May that 6.04 million BTC, or 30.2% of issued supply, had public-key exposure at rest. It classified 1.92 million BTC as structurally exposed through output design and 4.12 million BTC as operationally exposed through address reuse, partial spending or custody practices.

The research did not claim those coins can be stolen today. Instead, it measured where public keys are already visible and where better wallet management may reduce exposure. Exchange-related balances represented 1.63 million BTC within Glassnode’s operational category.

However, BitGo and Silence Laboratories tested post-quantum signing inside an institutional custody workflow in May. In related coverage, nine companies pledged $15 million over three years to a Bitcoin security consortium that named post-quantum research as its first focus.

BitGo has not disclosed how many clients can access the controls, whether they carry separate fees or when support may expand. Institutions can use the tools to review and move exposed balances, while wider protection will depend on future Bitcoin proposals and adoption.