Bitcoin (BTC) Wallet Sweep Moves 594 BTC in Three Blocks

Bitcoin News

A coordinated sweep of 594.48 BTC across 500 transactions in a three-block window has coincided with a Coldcard Mk3 security advisory from Coinkite. The Canadian hardware maker said on July 30 that seeds created on Mk3 firmware 4.0.1 through 5.0.3 may put funds at risk, while early analysis indicates Coldcard Mk4, Q and Mk5 models are unaffected. Seeds protected by a BIP-39 passphrase face minimal risk, and the passphrase is not the device PIN. The transferred coins were worth roughly $38.2 million when Bitcoin traded near $64,324, but no public evidence has tied the Mk3 seed warning directly to those transactions. Coinkite recommended generating a new seed on an unaffected device, confirming the backup and receiving address, sending a small test transaction, and moving the remaining balance only after the test clears. For users who still rely on an Mk3, the advisory described two fallback paths: adding a strong, unique BIP-39 passphrase as a temporary safeguard, or creating a dice-only seed on an empty Mk3 running firmware 4.1.9 with at least 99 rolls of a fair six-sided die. The company said the investigation remains active and has promised a formal technical review. The advisory framed the migration as precautionary pending the technical review. Its guidance urged users to preserve old backups until migration is complete, verify every address on the hardware screen, and avoid entering seed words on websites or untrusted devices. Each address should be checked character by character on the device display, and the old seed backup should remain stored offline until the new wallet receives the full balance. At the time of writing, the root-cause findings had not been published, leaving the relationship between the advisory and the sweep timing related but unproven. For broader coverage of the network, see our Bitcoin hub, and for background on the asset, read What is Bitcoin (BTC)? Complete Guide.

The on-chain movement drew attention after a self-reported Reddit account described a wallet funded by a Coldcard Mk3 seed that was later restored onto a Mk4, but that single claim does not establish a wider link. On-chain data reviewed by AnchorWatch CEO Rob Hamilton showed 1,324 unspent transaction outputs moving through 500 transactions inside a three-block window, sweeping 594.48 BTC from single-signature addresses. Hamilton said the pattern looked like flawed entropy during wallet generation, while cautioning that this was a preliminary read rather than a confirmed cause. Wizardsardine CEO Kevin Loaec offered a related hypothesis: a low-randomness generator, possibly inside a software library, secure element, device batch or firmware version, may have produced seeds that were easier to guess. Loaec suggested an attacker could have used an AI-generated script to search a narrow set of BIP-84 derivation paths, which would help explain why the activity concentrated in native SegWit addresses and why some wallets were only partially emptied. He warned that partially drained wallets could remain vulnerable if the assumption is correct, and that funds in other address types might face exposure if the scanning activity broadens. The sweep, valued at about $38.2 million when Bitcoin changed hands near $64,324, later saw 562 BTC consolidated into another address. No public technical report has yet identified the faulty component, measured the entropy shortfall, or shown how private keys were derived. The available evidence therefore points to a timing overlap between the Mk3 advisory and the sweep, not a proven common cause. The preliminary analyses emphasize that the sweep involved single-signature addresses, not multisignature setups, which narrows the immediate scope of the observed activity. No researcher has published a reproducible method for deriving the keys. Because wallet-generation flaws can affect automated tooling as well as hardware devices, the episode also raises questions about AI Crypto Wallet safety and key-management hygiene.

COINOTAG's proprietary 42-indicator composite S/R scoring engine shows Bitcoin under moderate resistance at $64,533, scored 53/100 from EMA 50 and Pivot Point, while stronger supply sits at $67,311, scored 76/100 from EMA 100 and Keltner Upper. Immediate support at $63,821 carries 79/100, driven by SMA 50 and high-volume-node confluence. Derivatives are cautiously long: funding is 0.0053%, open interest is $12.53 billion, and the long/short account ratio is 1.61. With Fear and Greed at 25/100, a bear market sentiment zone, a close above $67,311 would favor $70,325, while losing $63,821 would shift focus to $61,757. Bitcoin's 69.7% COINOTAG-tracked market share favors altcoin caution.