消息人士称，在一笔价值 3800 万美元的清扫之后，Coldcard 钱包的暴露范围已超出 Mk3。

Why it matters

The suspected theft strikes at hardware wallets' core promise: users can follow the prescribed self-custody process and still lose funds if seed generation fails.

Rodolfo Novak (@nvk) and Peter Gray's Coinkite warned Coldcard Mk3 owners to move their bitcoin after identifying a seed-generation issue that may have exposed wallets created over a span of more than five years. But a source familiar with the incident told RuntimeWire the problem is "not just Mk3." The source did not identify other affected devices or specify whether the statement referred to the seed flaw, the wallets swept, or both.

该警告发生在 7 月 30 日早些时候对大约 500 个地址进行的一次协调性资金转移之后，约有 594 个 bitcoin 被转移。按周五的 bitcoin 价格计算，这些资产价值约 3,810 万美元。公开分析将这些转账关联到一个接收地址，资金在大约 25 分钟内到达该地址，然后大部分被集中转移到其他地址。一位报告损失的钱包所有者表示，受影响的助记词是在 2021 年购买的一台 Coldcard 上生成的。

Coinkite 的7 月 30 日安全通告 确认，在运行固件 4.0.1 或任何更高版本的Coldcard Mk3上生成的助记词可能存在风险。Coinkite 并未确认全部 594 BTC 的转移均来自 Mk3 钱包，也未确认约 500 个发送地址即代表 500 名独立受害者。其公开通告基于早期分析称 Coldcard Mk4、Q 和 Mk5 设备不受影响，但该结论因该消息来源的声明而变得复杂。

That distinction remains important. The blockchain confirms the transfers, and the advisory confirms an Mk3 seed-generation problem. The public evidence does not yet establish that every input in the sweep was tied to the same flaw, while the source's statement does not establish which additional devices or wallets may be involved.

A security product built for self-custody

Gray, a University of Waterloo mathematics and computer science graduate, introduced Novak to Bitcoin after reading its whitepaper in 2011. The pair first built the BTC Look blockchain explorer and later created Coinkite after failing to find a Bitcoin wallet and payment terminal they wanted to use themselves, according to a 2018 profile of Coinkite.

Gray（毕业于 University of Waterloo 的数学与计算机科学）在 2011 年读了比特币白皮书后把 Novak 介绍给了 Bitcoin。根据对 Coinkite 的一篇2018 年专题报道，两人最初构建了 BTC Look 区块链浏览器，随后因为找不到他们自己愿意使用的 Bitcoin 钱包和支付终端而创建了 Coinkite。

Novak, a product designer who previously worked at Method:CRM and financial-data provider Quandl, has described Coldcard as a product born from his dissatisfaction with existing hardware wallets. Coinkite launched the Bitcoin-only device around 2018 and built its pitch around offline key storage, air-gapped transaction signing and publicly inspectable firmware.

Novak（曾在 Method:CRM 和 金融数据提供商 Quandl 工作过的产品设计师）曾将 Coldcard 描述为源于他对现有硬件钱包不满的产物。Coinkite 大约在 2018 年推出了这款仅支持 Bitcoin 的设备，并将其卖点建立在离线密钥存储、物理隔离的交易签名以及可公开检查的固件之上。

The incident cuts into that central promise. Coldcard users chose dedicated hardware to remove private keys from internet-connected devices and avoid dependence on an exchange or software-wallet provider. A failure during seed creation compromises the secret at the root of that security model, even when the owner follows the expected storage practices afterward.

这一事件削弱了这一核心承诺。Coldcard 用户选择专用硬件，是为了将私钥从联网设备中移除，并避免依赖交易所或软件钱包提供方。在助记词生成期间发生的失败会破坏该安全模型根本的秘密，即便持有者事后遵循了预期的存储实践也无济于事。

Coinkite's alert applies specifically to seeds created on a Mk3 beginning with firmware 4.0.1, released on March 29th, 2021. Importing an older seed into an affected device is a different case from generating the seed on that device. The company says Mk4, Q and Mk5 devices are unaffected, but the source's statement leaves open whether the broader incident reaches beyond the Mk3 flaw described in the advisory.

Coinkite 的警报具体适用于在 Mk3 上从固件 4.0.1（于 2021 年 3 月 29 日发布）起生成的助记词。将旧助记词导入受影响设备与在该设备上生成助记词是不同的情况。公司称 Mk4、Q 和 Mk5 设备不受影响，但该消息来源的声明仍然无法排除更广泛的事件是否超出通告中描述的 Mk3 缺陷范围。

A predictable fallback narrowed the Mk3 search space

Coinkite's advisory does not describe the technical mechanism, but Block's engineering analysis identifies a predictable random-number-generator fallback and a reseeding path limited to 32 bits. Under the conditions that triggered the fallback, the firmware could produce wallet seeds from a far smaller set of possibilities than users would expect from a properly generated BIP-39 seed.

Coinkite 的通告没有描述技术机制，但Block 的工程分析指出存在可预测的随机数生成器回退机制以及一个仅限于 32 位的重新置种(reseed)路径。在触发回退的条件下，固件可能仅从一个远小于用户对正确生成的 BIP-39 助记词所期望的可能集合中生成助记词。

A 32-bit search space contains about 4.3 billion possible values. That is large for manual guessing but tractable for systematic enumeration compared with the effective search space expected from secure wallet entropy. An attacker able to reproduce the fallback behavior could generate candidate wallets, monitor their addresses and move funds after finding a match.

32 位的搜索空间包含大约 43 亿个可能值。对于手动猜测来说这是很大的，但与安全钱包熵所期望的有效搜索空间相比，对于系统化枚举来说这是可处理的。能够复现该回退行为的攻击者可以生成候选钱包、监视其地址，并在找到匹配时转移资金。

The analysis supplies a plausible path from the Mk3 firmware defect to wallet compromise, but it does not by itself prove that the same attacker controlled every input in the 594 BTC sweep. Nor does it establish how often affected devices entered the fallback path or explain how other devices may be implicated.

该分析为 Mk3 固件缺陷导致钱包被攻破提供了一个合理的途径，但它本身并不能证明在那次 594 BTC 的转移中每一个输入都是由同一名攻击者控制。它也没有说明受影响的设备进入回退路径的频率，或解释其他设备可能如何被牵连。

The advisory leaves a version mismatch

Coinkite's advisory says the issue extends through firmware 5.0.3 and describes that version as the final Mk3 release. Coinkite's own Mk3 firmware archive instead lists version 4.1.9, released on June 26th, 2023, as the final release for the Mk3 and Mk2. The broader firmware archive lists 5.0.3 as an Mk4 release.

Coinkite 的通告称该问题延续至固件 5.0.3，并将该版本描述为 Mk3 的最终版本。但 Coinkite 自己的Mk3 固件归档反而将 4.1.9 版（于 2023 年 6 月 26 日发布）列为 Mk3 与 Mk2 的最终版本。更广泛的固件归档则将 5.0.3 列为 Mk4 的发布版本。

Mk3 users should therefore follow the advisory's wider instruction: treat any seed generated on an Mk3 running version 4.0.1 or later as exposed, regardless of the version-number discrepancy. The source's statement does not provide enough detail to extend that instruction to a specific additional model.

因此 Mk3 用户应遵循通告的更广泛指示：将任何在运行 4.0.1 或更高版本的 Mk3 上生成的助记词视为已暴露，不论版本号存在何种差异。该消息来源的声明并未提供足够细节，将该指示扩展到其他特定机型。

Coinkite says wallets protected by a strong BIP-39 passphrase face minimal risk from this issue. That protection refers to a separate passphrase attached to the seed, rather than the device PIN. A passphrase creates a distinct wallet whose keys cannot be derived from the seed words alone.

Coinkite 表示，受强 BIP-39 密码短语保护的钱包面临的风险很小。该保护指的是附加在助记词上的独立密码短语，而不是设备 PIN。密码短语会创建一个独立的钱包，其密钥无法仅由助记词单词推导出来。

For users without another device, Coinkite recommends moving funds temporarily into a new wallet protected by a long, unique passphrase. Coinkite also documents an advanced option using at least 99 physical dice rolls on Mk3 firmware 4.1.9, which bypasses the device's normal random-number generator. The safer route is to create a fresh seed on an unaffected device, verify a receiving address on its screen and move the funds after a small test transaction.

对于没有其他设备的用户，Coinkite 建议将资金临时转入由长且唯一的密码短语保护的新钱包。Coinkite 还记录了一个高级选项：在 Mk3 固件 4.1.9 上至少使用 99 次实体掷骰，以绕过设备的正常随机数生成器。更安全的做法是在未受影响的设备上创建新的助记词，在其屏幕上验证接收地址，并在小额测试交易后迁移资金。

Confirmed Bitcoin transactions have no administrator who can reverse them. Stolen funds can be traced and potentially seized if they reach an identifiable service, but victims cannot cancel the transfers or restore balances through Coinkite.

已确认的 Bitcoin 交易没有可以撤销它们的管理员。被盗资金如果流入可识别的服务，可能会被追踪并有可能被查封，但受害者无法通过 Coinkite 取消这些转账或恢复余额。

Coldcard's source code and reproducible builds made the product more inspectable than closed firmware. Coinkite itself acknowledges that public code does not prove a product has no defects. The incident gives that caveat a measurable cost: roughly $38 million in transfers now suspected of exploiting security products designed to eliminate reliance on anyone except their owners.

Coldcard 的源代码和可再现的构建使该产品比封闭固件更易于审查。Coinkite 自身也在承认，公开代码并不能证明产品没有缺陷。该事件为这一警告带来了可衡量的代价：大约 3,810 万美元的转移现在被怀疑利用了旨在消除对除所有者之外任何人依赖的安全产品。