Firmware

Attackers have drained nearly $114 million in bitcoin from more than 709 addresses after exploiting a Coldcard firmware flaw that weakened wallet seed randomness. The incident is forcing the self-custody community to confront uncomfortable questions about verification, reputation, and how security review is encouraged or discouraged.

A new wave of bitcoin sweeps tied to Coldcard-generated addresses may have lifted observed losses to about 1,816 BTC, or nearly $114 million, since July 30. Researchers say the latest pending transactions appear to use replace-by-fee, giving alert users a narrow window to outbid the attacker before confirmation.

A Coldcard firmware vulnerability tied to weak software-based randomness has been linked to three waves of bitcoin sweeps across thousands of addresses. The latest activity is targeting smaller balances and using more complex onchain collection patterns.

Bitcoin slipped nearly 3% after a Coldcard wallet bug rattled confidence in cold storage security and triggered fresh caution across crypto markets. With spot Bitcoin ETFs seeing a $265 million daily outflow, traders are watching whether BTC can defend $60,000 or risk a deeper move toward $50,000.

Binance founder Changpeng Zhao has urged crypto holders to spread funds across multiple wallets after a major Coldcard hardware wallet exploit. The incident exposed a long-running firmware flaw that allowed an attacker to reconstruct private keys offline and drain bitcoin from affected addresses.