Galaxy Research said Friday that nearly 1,200 addresses were drained of more than 1,000 BTC, worth about $70 million in transactions it linked to a vulnerability affecting Coldcard hardware wallets.
On Thursday, Coinkite advised that there was an ongoing issue affecting seeds generated on Coldcard Mk3 devices.
"Out of an abundance of caution, Coinkite is warning all users who generated a seed using a Mk3 on version 4.0.1 (March 2021) or any subsequent version that their funds may be at risk," the crypto hardware maker said.
Coinkite later expanded the advisory to include certain Mk4, Mk5 and Coldcard Q firmware versions, and released emergency firmware updates for all affected models.
Coinkite CEO Rodolfo Novak, known as NVK, apologized Friday and said the company took "full accountability for the firmware bug," acknowledging that its review process had failed to catch it.
