A Coldcard Mk3 firmware flaw drained up to 1,082 BTC in 41 minutes. CZ urges users to split funds as self-custody confidence takes a major hit.

Bitcoin security experts said the unexplained $38 million wallet drain may involve flawed seed-generation entropy, though the cause and any Coldcard link remain unconfirmed.

Coinkite recommends that Mk3 users create a strong, unique BIP-39 passphrase on the device and move funds to the resulting wallet.

Over $70 million in Bitcoin has been pinched. Coldcard has since urged its users to take precautions.