$38M Bitcoin Drained and Nobody Can Explain It: Coldcard Just Issued a Rare Warning
$38 million in Bitcoin vanished from a wallet, and the security experts examining it still have no answer. At the same time, Coinkite, the company behind the widely trusted Coldcard hardware wallet, just told all Mk3 users to move their funds immediately over a newly identified seed-generation risk. Two separate events. One very bad week for Bitcoin self-custody.
Coldcard Mk3: Move Your Funds Now
Coinkite's warning is not a drill. The company identified a potential vulnerability in how the Mk3 model generates seed phrases, the master key to every wallet created on that device. If that process is compromised, every satoshi stored using an affected seed is at risk, regardless of how careful the owner has been with their private keys.
This is the kind of flaw that makes hardware wallets terrifying. You followed every rule. You kept it offline. You never touched a sketchy link. And it may not matter.
Coinkite has not released full technical details, likely to prevent bad actors from moving faster than users can respond. What they have said is clear: migrate your funds to a new wallet generated on a Mk4 or another trusted device. Do it before someone else figures out what Coinkite already knows.
If you own a Coldcard Mk3, this is your only task today.
The $38M Drain Nobody Can Explain
Separately, Bitcoin security researchers are pulling apart a wallet drain totaling $38 million, and the how is still missing. No obvious phishing trail, no confirmed exchange hack, no known exploit tied to the loss. Just funds that moved when they should not have.
That uncertainty is the most alarming part. A known exploit has a patch. An unknown one has victims.
Whether the two events are connected remains unconfirmed. But the timing has researchers paying close attention. A seed-generation flaw on a popular hardware wallet, combined with an unexplained nine-figure drain, is exactly the kind of overlap that turns into a very large story very fast.
What Crypto Holders Should Do Right Now
If you use a Coldcard Mk3: Stop waiting. Generate a fresh wallet on an unaffected device, transfer your holdings, and verify the receiving address twice before sending anything.
If you use any hardware wallet: Check the manufacturer's security channels today. Vulnerability disclosures are often quiet before they are loud.
Watch for updates on the $38M drain. If a root cause surfaces that points to a broader infrastructure flaw, the blast radius could extend well beyond one wallet. The next 48 hours matter.