Timeline

Coinkite publish the Mk3 Security Advisory, initially scoping the issue to Mk3 and stating Mk4, Q and Mk5 were "not affected based on our early analysis". That earlier state is recovered from the Internet Archive; this project's own capture of the page began 1 August. Block's engineering team publish their technical report the same day with a wider affected scope. Block states that it published before the vendor's analysis was complete because it believed exploitation was active.

Coinkite's entropy technical backgrounder displays a 30 July publication date. Its state held on 1 August includes Mk4, Mk5 and Q and presents scenarios near 72 bits for those models and 40 bits for Mk3. The first appearance of that expanded scope relative to the 31 July hotfix records has not been established.

An official COLDCARD update directs Mk3 users on v4.0.1 or later without at least 50 private independent dice rolls to migrate, and directs affected Mk4, Mk5 and Q users to update before generating a new seed. The vendor's stated Mk3 range remains narrower than the v4.0.0 start established from source and release records.

NVK publishes an apology on behalf of Coinkite, taking accountability, committing to a technical postmortem covering why their own review missed it, and offering written incident summaries to affected users for police reports and insurance claims.

Block's Clay Garrett reports that the operator used a paid account at a well-known blockchain-services provider to query the source addresses during the sweeps, and that the provider's internal logs matched the suspected workflow "with extraordinary specificity, including the number, timing and sequence of requests". Shared with authorities.

The community coldcard-watch tracker expands its headline from the first 1,195-address episode to two episodes totalling 2,321 addresses and 1,128.4717 BTC. This records the tracker's changed attribution. The relationship of the later 45.9 BTC cluster to the principal incident set remains unverified.

Coinkite ask owners to treat migration as urgent: follow the advisory for the model, upgrade the device, generate a new seed, move funds carefully, and pass the message to owners who are less online. The post quotes the vendor's 31 July urgent update, which states the Mk3 boundary as 4.0.1 and later and carves out seeds created with at least 50 private, independent dice rolls.

Kevin Loaec of Wizardsardine reports that Mk4, Mk5 and Q wallets are "now actively drained", quoting Tomer Strolight's account of a COLDCARD Mk4 seed deliberately left funded as a duress wallet and swept overnight to bc1qzm5pauxyv7t7vqstzpumqcn066wfjsmev34mf3. The same post argues that breaking an Mk4 is harder than breaking a weak passphrase, so Mk3 seeds behind a passphrase at or under roughly 32 bits are at immediate risk. This is a reported third-party account of a single wallet. The pinned funds dataset here covers the 30 and 31 July waves and holds no addresses, so it cannot corroborate the sweep. The named destination does appear in held captures of a community tracker as a 1 August vault holding 0.33203236 BTC from 16 sweeps, and a later capture of that tracker records its Mk4 attribution as withdrawn in favour of an Mk3-origin seed. The device model behind a sweep is not visible on chain.

The Mk3 advisory carries a third dated update. It replaces the blanket warning that affected Mk3 owners' funds "may be at risk" with two published conditions: funds are at risk unless the seed was created with at least 50 fair, independent, private dice rolls and the wallet is protected by a strong, unique BIP-39 passphrase. The passphrase section moves in both directions, saying that reduced seed entropy alone is not enough to reach a passphrase wallet, and also that a strong passphrase does not repair the affected seed and that passphrase users should still migrate. The backgrounder carries the same update, while the banner on the vendor's downloads and terms pages moves from "may be at risk" to "are at risk". The disclosure page sets the three recorded revisions side by side.

The Mk3 advisory carries a fourth dated update, and it settles which devices the vendor says are involved. The affected range becomes "Mk2 and Mk3 firmware versions 4.0.1 through 4.1.9 inclusive", the fixed release is listed as "Mk2/Mk3: version 4.2.0 or later", and the one-device migration section, the optional dice-only section and the closing migration steps are rewritten from Mk3-only to Mk2-or-Mk3 wording. The backgrounder carries the same dated update and the same substitution, saying the active PRNG on "Mk2 and Mk3" was seeded primarily from device and timing state. Until this revision the advisory named only the Mk3, and the vendor downloads-page listing was the only vendor evidence placing the Mk2 in either the affected range or the hotfix. The published lower bound stays at 4.0.1 for both models, so the v4.0.0 boundary difference is unchanged. The disclosure page sets the four recorded revisions side by side.

Galaxy Research identify a third sweep wave of 207.7294 BTC and revise their estimated observed size of the incident to 1,367.05 BTC across 4,585 addresses, superseding the roughly 1,083 BTC total they published on 31 July. The same thread reports 1,366.3865 BTC under attacker control with all endpoint attacker addresses fully unspent on chain, and carries Galaxy's own method limit: the work derives solely from block data and the unspent-output set, and Galaxy has not tested whether the addresses it identifies as possible victims were in fact generated with low entropy. Galaxy also states that the vulnerable firmware shipped on 17 March 2021 around block 674,951 and that no coin identified in waves 1 to 3 was created before that block; what that means for the published version ranges is on the firmware page. Galaxy's scope is wider than the 30 and 31 July sets reconciled on the funds-accounting page, which does not adopt the revised total.