Topic
self-custody
8 stories
Coldcard seed bug drives a spike in new Bitcoin addresses as users flee 2021-era wallets
Coinkite users have lost at least 1,816 BTC — roughly $116 million — in four theft waves since July 30, traced to a 2021 firmware bug that generated wallet seeds with a weak software random number generator.
BTCPay Server tells users to patch or power down, citing an actively exploited critical bug
BTCPay Server told users on Aug. 7 to upgrade to version 2.4.2 or shut down their servers, saying a critical flaw is already being exploited and funds may be at risk.
Coldcard's seed flaw is still live, and an exchange is already selling the moral
Coinkite says the entropy flaw behind up to $114 million in stolen bitcoin is still live and requires manual migration, while OKX claims the theft is driving record deposits to exchanges.
Fourth Coldcard sweep is running live, with estimated losses near $114 million
Galaxy's Alex Thorn says a fourth wave of sweeps against Coldcard-generated bitcoin addresses began Monday, putting estimated losses since July 30 near 1,816 BTC, or roughly $114 million.
Coldcard wallet drain reaches $88 million, per Decrypt — with the mechanism still unspecified
Decrypt reports that losses from an exploit hitting Coldcard bitcoin wallets have reached $88 million and are still climbing, with the attack vector and vendor response not yet specified.
CZ warns Bitcoin holders after reported $70 million Coldcard exploit
Decrypt reported on August 1 that Binance founder Changpeng Zhao warned Bitcoin holders after a roughly $70 million exploit involving Coldcard hardware wallets, with the attack path still unspecified.
Galaxy puts the Coldcard drain at 1,082 BTC across 1,196 wallets — roughly double the first count
Galaxy Research says an attacker swept 1,082.65 BTC from 1,196 Coldcard wallets in 41 minutes on July 30 by reconstructing weakly generated seeds offline, without touching a single device.
Trezor executive concedes hardware wallets are "clunky" but rejects ZachXBT's "complete garbage" verdict
On-chain investigator ZachXBT called all hardware wallets "complete garbage" for high-stakes use; Trezor's commercial chief conceded the tools are "clunky" but rejected the blanket verdict, while Tornado Cash's Roman Storm sided partly with ZachXBT.