Well this sucks.

I'm not a big social media user. I woke up this Saturday morning and had a look at the list of podcasts on my phone. One was an "EMERGENCY BITCOIN UPDATE" from What Bitcoin Did. That got me googling, and I that's how I found that Coldcard Mk3 generated seeds were vulnerable.

My seed was generated by a Coldcard Mk3, so I immediately loaded up Sparrow wallet to get about transferring the corn away, but it had been drained 2 hours ago – about a day after it seems this all started.

I'm not sure what I should have done differently. Code errors happen, AI has made them easier to discover. I guess that's just some of the risk that was contributing towards what I expected to be a better asset.

But I assume Coldkite has a list of email addresses associated with lists of orders of Mk3 wallets, and if they do and didn't send me an email, then I think that would be unforgivable. I live in Asia, so I was asleep for most of the last 8 hours; my wallet was drained while I was asleep. But the people who made the wallet knew this yesterday, and did move heaven and earth to let me know? That's the thing I can't understand.

There are probably more people out there with vulnerable seeds, and I assume that not all of them have been drained yet. If you know anybody who may have one, please spread the word fast. I lost 0.77 bitcoin today. I hope this message may help prevent some others from doing the same.

FWIW, thanks to the team at What Bitcoin Did for getting the message out there, even if it was a little too late for me.

Edit:

Temporary new wallet, in case anybody is feeling generous: bc1qwxtgghgkdgxxtddejttxhf4xc8vq9rz4w54ktx