**Coldcard MK3 Hacked: Over $70 Million in Bitcoin Stolen in AI-Powered Breach**
In a startling incident that has shaken the cryptocurrency security landscape, over a thousand bitcoins—valued at more than $70 million—are believed to have been stolen following a critical vulnerability discovered in one of the most trusted hardware wallet brands. The breach, first discussed publicly in late July, targets devices manufactured by Coinkite, a leading producer of Bitcoin cold storage solutions. According to industry analysts, artificial intelligence (AI) played a role in identifying and exploiting the flaw.
### What Was Compromised?
The vulnerability affects Coldcard MK3 hardware wallets running firmware versions from March 2021 through July 2026, specifically models MK3, MK4, and MK5, including the Coldcard Q. The flaw lies in the way these devices generate deterministic private keys from seed phrases.
Wallets that were generated using the default BIP-39 seed generation process—without additional user-supplied entropy such as dice rolls or an extra passphrase—are at heightened risk. This means users who relied solely on the standard 12- or 24-word recovery phrases may have unknowingly created predictable private keys.
### Immediate Response and Firmware Fix
Upon discovery, Coinkite released an urgent advisory and issued a firmware update. As of July 31, 2026, updated firmware is available:
– **MK3 users** should upgrade to version 4.2.0 or later
– **MK4 and MK5 users** must update to version 5.6.0 or later
– **Coldcard Q users** need version 1.5.0Q or later
However, the company emphasized that simply updating the firmware does not secure previously compromised keys. Because the private keys were generated using weak entropy, they remain vulnerable. Users must create a new wallet and transfer funds to fresh addresses to ensure safety.
### Complex Risks: Multisignature Setups
Security researcher Peter Todd highlighted additional risks for multisignature wallets that rely on multiple Coldcard devices. In a 2-of-3 configuration, for example, if two Coldcards are compromised and the third device is used to reveal the multisignature script—even unconfirmed—an attacker could potentially execute a faster, higher-fee transaction to steal funds.
A temporary mitigation exists through the MARA mining pool’s private mempool service, Slipstream, which keeps transaction details confidential until confirmation. Still, anyone who has reused addresses is urged to move funds immediately.
### Beyond the Breach: AI and the Future of Crypto Security
NVK, co-founder of Coldcard, provided deeper analysis following the breach, noting that AI-assisted code review is transforming how vulnerabilities are discovered—and exploited. Open-source firmware, once considered transparent and trustworthy, can now be rapidly audited by malicious actors using advanced AI tools.
Industry-wide discussions held in real-time audio sessions reveal growing consensus: the era of AI-driven cybersecurity audits is upon us. Companies must now proactively defend against attackers using the same technologies. This breach may ultimately lead to a stronger, more resilient self-custody ecosystem—but not before hard lessons are learned.
### Looking Ahead
The incident has also renewed interest in best practices such as user-generated entropy (e.g., dice rolls) and upcoming Bitcoin improvements like covenants, which could enable more sophisticated wallet rules and enhance long-term security.
—
### FAQ
**Q: Which Coldcard models are affected?**
A: Coldcard MK3, MK4, MK5, and Coldcard Q models are affected.
**Q: How do I know if my wallet is vulnerable?**
A: If your seed phrase was generated without using dice rolls or an extra passphrase, and your firmware is outdated, your wallet may be at risk.
**Q: What should I do if I own a vulnerable Coldcard?**
A: Update your firmware immediately, create a new wallet, and transfer your funds to the new address. Do not reuse old addresses.
**Q: Does updating firmware fix already compromised keys?**
A: No. Updating firmware does not repair existing seeds. You must migrate funds to a new wallet.
**Q: Are multisignature wallets safe?**
A: Some multisignature setups may be vulnerable if shared keys are exposed. Using services like MARA’s Slipstream can reduce risk during transaction broadcasting.
**Q: Was user-generated entropy always recommended?**
A: Yes. Experts have long advised adding manual entropy—such as dice rolls—to strengthen seed phrase randomness.
—
### Conclusion
The Coldcard MK3 breach marks a turning point in cryptocurrency security. With over $70 million stolen and AI tools increasingly leveraged by attackers, the industry faces both an urgent challenge and an opportunity. While the immediate outlook demands caution and rapid migration of funds, the long-term consequence may be a more rigorous, AI-hardened approach to wallet security. For now, users must act swiftly—but the lessons learned here could define the next generation of self-custody.
