Coinkite warned that Coldcard Mk3 devices (firmware 4.0.1–5.0.3) may have generated seeds with weak entropy, putting funds at risk. Roughly 594.5 BTC (~$38.3M) was drained from 500 single-sig addresses in coordinated txs on July 30; experts link it to the flaw. Mk4/Q/Mk5 unaffected per Coinkite. Users should add a strong BIP-39 passphrase or migrate seeds carefully to new hardware. No confirmed market-wide impact yet; isolated hardware risk amid ongoing investigation.(unfolded.)