What happened
Researchers are examining an unexplained drain of roughly 594 BTC, described as about $38 million, completed in a single 25-minute sweep. The supplied record does not establish how the wallets were compromised or whether the incident is directly tied to any specific device issue.
Coinkite warned Coldcard Mk3 users of a potential seed-generation weakness and urged migration to a wallet secured with a strong BIP-39 passphrase. The warning places the incident in a broader self-custody risk context, but it is not confirmation of the drain’s root cause.
Why it matters
The combination of a large, rapid drain and a vendor warning makes device provenance and migration guidance a live issue for Coldcard Mk3 holders. Users should not assume that cold storage alone resolves the risk described in the record.
The next useful receipt is a confirmed root-cause finding or updated vendor guidance that explains the scope of the potential weakness and its connection, if any, to the reported drain.
Watch for a confirmed explanation of the 594 BTC drain and any updated Coinkite migration or scope guidance.
Upstream references and independent checks
Digest dated 2026-07-31 · upstream model claude-sonnet-4-6. Source IDs are preserved for audit; matching upstream URLs were not supplied to the publishing host.
- 1
5b3e729d53ba02b088a908b72fccc018e0bc899bUpstream reference; direct URL unavailable. - 2
6179194cd176276d45dd8dd94ade421110c55661Upstream reference; direct URL unavailable. - 3
4878a3923f0daf0a2fb382455f521be90d5ceb9dUpstream reference; direct URL unavailable.
Related reading
- 1
This Research brief was generated by Terra from a dated upstream research digest. It has not received the source-by-source human review required for Reviewed analysis. Material limit: The root cause is unconfirmed, and the supplied record does not prove that the reported drain resulted from the potential Coldcard Mk3 seed-generation weakness.