Coldcard Drain Hits 1,200 Addresses-Migrate or Stay Exposed

Coldcard losses are still rising

The event is still unfolding. Nearly 1,200 addresses have reportedly been drained, with more than 1,000 BTC stolen, and BTC losses linked to the Coldcard wallet vulnerability have now reached $70 million in the latest update shared today. This is not a closed patch story; it is an active fund-loss event while affected seeds remain in circulation, and updating the firmware does not repair a seed.

Who is actually exposed in the Coldcard vulnerability?

The headline is big, but the exposed set is narrower than the panic implies. The key question is not whether the story sounds alarming, but whether a seed was created on affected firmware without the documented dice-entropy exception.

Firmware version is the real boundary

The affected builds are Mk2/Mk3 firmware 4.0.1 through 4.1.9, Mk4 and Mk5 before 5.6.0, and Q before 1.5.0Q. If your seed was not generated on those firmware windows, this likely does not apply to you.

For Mk2/Mk3, the bug reduced effective entropy to roughly 40 bits instead of the intended 128. That helps explain how theoretical weakness can turn into practical sweeps. Coinkite also says seeds from affected Mk4, Mk5, and Q devices are less exposed than Mk2/Mk3, but still affected, with about 72 bits of entropy rather than 128.

The dice-roll safe harbor is real, but narrow

Coinkite's safe harbor is explicit: if the seed was created with at least 50 fair, independent, private dice rolls, it is not considered at risk from this RNG issue alone. That matters because many users cannot confidently prove they met that standard.

A passphrase helps, but it does not fix the seed

A strong, unique BIP-39 passphrase can reduce immediate exposure, but the advisory is clear that it does not repair an affected seed. In practice, that means passphrase protection is a mitigation, not a full resolution.

The practical takeaway is simple: if your seed was generated on the affected firmware and you do not have the dice safe harbor, you should review the migration guidance. If your device and firmware history fall outside that set, the risk from this specific issue is much lower.

What to do now if you may be exposed

After nearly 1,200 addresses were reportedly drained, the right response is a calm, correct workflow, not a rushed one. Coinkite's sequence is explicit: update first, generate a new seed, then migrate. That order matters because updating the firmware does not change or repair an existing seed.

Follow the correct order

• Install the fixed firmware for your specific model and release track before generating anything new.
• Generate a completely new seed on the updated device.
• Back up the new seed carefully, verify it, and send a small test transaction before moving the rest.
• Keep the old backup only until the migration is fully confirmed.

The attacker-side narrative is still active: a coordinated sweep of 594.48 BTC was reported from single-signature addresses, though no definitive public evidence has yet established that the Coldcard issue caused those transfers. That is enough to justify caution, not panic.

If you think your seed may fall into the affected group, the clearest next step is to verify your firmware history and follow the official migration path rather than waiting for broader confirmation.