Together with
Greetings Bitcoiner,
Welcome to Issue #614 of the Bitcoin Breakdown daily newsletter, where we’re rounding up the most talked-about developments in the Bitcoin-only space from the past weekend with our Quick Bits and Quick Media sections. But first, today’s Top Stories:
A Coldcard firmware bug let a thief drain roughly $88 million in Bitcoin, and the same public ledger is now tracing the f#cker down. Strike and AnchorWatch are turning AI loose on their own codebases before attackers do, and Bitkey shows how multisig strengthens wallet security.
🚨 If you're still holding bitcoin secured by a seed phrase generated on a Coldcard, we strongly recommend moving those funds to a newly generated wallet on a different hardware device, or a trusted exchange if necessary, as soon as possible. For the specific steps we recommend, read our full Coldcard Seed Rotation Advisory.
There will be many lessons from this incident, chief among them the value of independently generated entropy and, for larger holdings, multisig setups spanning hardware wallets from multiple vendors. Our hearts go out to everyone who lost bitcoin in this attack. Bitcoin itself was of course not compromised, but this event has shown that some assumptions about hardware wallet security deserve a second look.
One bright spot: over the past 3 days, developers, researchers, companies, and everyday Bitcoiners have worked together to understand the vulnerability, protect users, and help victims. We'll learn from this, improve our practices, and come out stronger. Self-custody remains one of Bitcoin's greatest strengths, but this week was a reminder that it demands constant vigilance.
A wallet failing is not bitcoin failing, any more than a burgled safe is a repudiation of gold. In 17 years nobody has broken bitcoin. They have only ever broken people's key management. Those are different problems and only one of them is yours to solve.
Last week's Coldcard disclosure exposed a basic failure: a hardware wallet can look secure while generating a predictable seed.
Jade Plus mixes randomness from several independent sources, including its hardware generator, camera, user input and the Blockstream app. Its hardware and firmware are public for review, and it can sign by QR without connecting to a computer.
Use the link below for 10% off Jade Plus, and add code JADEPLUSEXPRESS at checkout for free expedited shipping.
If your Coldcard seed was created with affected firmware, a new device is only part of the fix. Generate a new wallet on the replacement and move the funds. Updating Coldcard firmware or importing the old seed does not make that seed safe.
🕵️ Coldcard Thief's $88M Trail Leads Through Chain Data
Coinkite confirmed a firmware bug in Coldcard Mk3 devices, dating to a March 2021 update, that let attackers brute-force private keys from wallets without a strong passphrase. The theft has grown in waves to roughly 1,367 BTC (about $88.6 million) across 4,585 addresses, according to Galaxy Research.
Why it matters: Chain analysis usually gets framed as surveillance of ordinary users, but here it's tracking the thief instead. Every sweep leaves a public trail investigators can follow, the exact opposite of what a closed banking system would offer. Read more→
While one thief exploited weak randomness, defenders fight back...
🤖 AI Now Hunts Bugs in Bitcoin's Open Source Code
Strike CEO Jack Mallers confirmed the company runs an agentic system that reviews its codebase daily using frontier AI models, including the newly released open-weights model Kimi K3. AnchorWatch CEO Rob Hamilton is urging Bitcoin developers to do the same across their own repos.
Why it matters: Nobody here claims AI replaces security teams; Strike still runs human reviewers alongside the model. The real story is open-weights models giving Bitcoin's builders an extra set of eyes right when Coldcard just proved firmware bugs can hide for years. Read more→
Security researchers weren't the only ones patching bugs...
🔧 Bitkey Patches Bug, Says No Funds Were Ever at Risk
Bitkey disclosed a bug in its recovery and inheritance enrollment flow, tied to a shared random-number generator, and shipped an app-store patch the same day it was reported. Only 2nd generation devices with enrolled beneficiaries are affected.
Why it matters: A real bug produced a narrow, fast-patched issue instead of a nine-figure loss, and that's the multisig promise working as designed. Two hardware-wallet disclosures in three days isn't proof custody is getting less safe, it's proof architecture limits the damage. Read more→
Poll #614: What matters most for hardware wallet security?
Coldcard accused of ignoring the current vulnerability all the way back in 2022 despite allegedly getting reports of similar wallet-drain incidents from users, according to a post on Reddit.
OpenSats, a non-profit that funds Bitcoin development, announces that Coinkite's NVK will be stepping down from its board.
Jameson Lopp, CSO of Casa, lists 17 wallets and tools with historical weak random number generation flaws, noting that vulnerabilities like these are not new.
Bitcoin transfers under 1 BTC reach a total of 39,600 BTC on Friday, the highest since FTX's 2022 collapse, amid an ongoing Coldcard wallet hack, according to data from CryptoQuant.
Alexander Leishman, CEO of River, says that even though he feels proud that people are trusting his company to deposit funds as Coldcards get exploited, he is disappointed that people are having to move coins to custodians.
Parman, popular BIP 110 proponent, sparks backlash after proposing to collect donations for victims of the Coldcard hack, renting hashrate with donated funds and distributing mining proceeds to victims.
Bitcoiner Miguel completes an independent audit of Sparrow Wallet version 2.5.4 using Kimi K3, finding no malicious code or security issues.
Shelbit, a Dubai-based exchange, moves $4B for Iran's Revolutionary Guard linked gambling network, with $676M traced to Binance.
Mullvad, a privacy focused VPN provider, campaigns against proposed UK legislation enabling government spyware on phones, then faces billboard censorship from London Councils at Piccadilly Circus.
Minnesota bans Bitcoin ATMs statewide starting Aug 1, after officials report about $1M in senior citizen scam losses tied to kiosks from 2023 to 2025.
Japan and the US jointly intervene to support the yen after it hits a 40-year low, buying yen and selling dollars to curb disorderly currency swings.
Russia's government bans mining and mining pool participation in Moscow, Moscow Oblast, and parts of Kursk Oblast from Aug 15 through 2032, citing grid strain and potential electricity shortages.
Bitcoin mining difficulty falls to 126.23T, down 14% from January's 155.97T peak and 1.1% below year-earlier levels, marking only its second annual decline ever.
SeedSigner’s project lead highlights years of trolling and FUD from Coldcard’s NVK against Raspberry Pi-based Bitcoin signers, framing the dispute as a long-running hardware wallet rivalry over open-source DIY security and dedicated signing devices (Aug 2 | 4:14 min watch).
ForrestHODL, a Bitcoin educator, explains how to repurpose an old smartphone with the Cupcake app as an offline signing device to safely migrate bitcoin off vulnerable Coldcard wallets amid the RNG exploit (Aug 1 | 19:57 min watch).
Fernando Nikolić of BTC Perception reflects on the implications of the recent Coldcard hack, offering a pessimistic black pilled view of the future of Bitcoin's sovereign usage (Aug 1 | 13:16 min watch).
Dante Cook of Simply Bitcoin host warns that a $89M ColdCard wallet exploit, Strategy's potential $5B BTC sale, and looming Clarity Act regulations converge with Japan's currency crisis to threaten Bitcoin's self-custodial culture and price stability (Aug 3 | 16:19 min watch).
Matthew Kratter argues the Coldcard hardware wallet randomness flaw may be a state-level attack timed to BIP110, citing years-old drained-wallet reports, NVK's dismissive remarks toward Bitcoin plebs, and bricked-device firmware suspicions (Aug 3 | 8:29 min watch).
ICYMI: Crypto Guide, in an old video from 2023, warns that Coldcard Mk4 wallets created with under 15 dice rolls remain vulnerable, having already led to roughly 22.5 BTC stolen till that time of recording by scammers exploiting low-entropy seeds (Oct 23 2023 | 9:57 min watch).
Adam Livingston, in a video for Firefish, argues that Bitcoin's roughly 49% drawdown masks a resilient network as realized cap holds near $1T, signaling a historic buy opportunity ahead of the next cycle (Aug 3 | 16:20 min watch).
Anita of Bitcoin For Fairness argues in a documentary that Bitcoin's fixed supply and censorship-resistance help protect equality, privacy, free speech and property rights for people facing financial exclusion in Zimbabwe, Nigeria and beyond (Jul 31 | 24:41 min watch).
The Sat Stacker Show, a Bitcoin education channel, warns Coldcard users of the device’s firmware entropy bug that enabled attackers to steal over 1,000 BTC and urges immediate fund transfers plus stronger passphrase and multisig protections (Aug 2 | 10:47 min watch).
Guy Swann of Bitcoin Audible warns about the a critical Coldcard entropy bug that lets attackers regenerate weak seed keys and drain wallets, urging MK3-MK5 and Q users to immediately move funds via Sparrow, Nunchuk, or exchanges (Aug 1 | 29:25 min watch).
Luke Mikic, a Bitcoin YouTuber, speaking at BTC Prague 2026, argues that Bitcoin's accelerating exchange supply squeeze combined with a coming 10-100x explosion in global wealth could push BTC toward $257M-$8.57B per coin by 2050 (Aug 1 | 17:50 min watch).
Nik Bhatia explains how a Coldcard seed-generation flaw drained BTC and urges self-custodial holders to verify their entropy and diversify storage immediately (Jul 31 | 25:40 min watch).
Joe Nakamoto, a Bitcoin content creator, spends two weeks in Costa Rica's Uvita region documenting how hundreds of locals and expats earn salaries, spend, and save in bitcoin through a grassroots Lightning-powered circular economy outpacing El Salvador's top-down experiment (Aug 1 | 14:17 min watch).
Adam Livingston, in a video for Swan Bitcoin, argues that AI's $2.4T capex race faces a brutal hurdle-rate problem while even a 1% Magnificent Seven rotation into bitcoin would dwarf 20 years of new Bitcoin issuance (Aug 1 | 18:26 min watch).
Matthew Kratter urges viewers to disable RBF on Bitcoin Knots nodes and move funds off compromised Coldcard-generated seeds immediately, warning of weak entropy exposing multisig users to theft (Aug 2 | 9:44 min watch).
Rustin of Simply Bitcoin warns Coldcard MK3 users of the firmware entropy bug draining thousands of wallets, urging immediate fund migration, stronger passphrases and multisig adoption while cautioning against scams (Aug 2 | 16:58 min watch).
Isabella Santos of BTC Isla urges ColdCard users to move their bitcoin to fresh high-entropy seed wallets, update firmware, verify wallet security, and avoid relying on device-generated seeds as thefts exceed 1,000 BTC (Aug 1 | 5:50 min watch).
Tony of The Bitcoin Way, urges calm amid the Coldcard vulnerability, outlining what happened, how users should respond and what happens next (Aug 1 | 8:04 min watch).
Michael Tanguma, Founder and CEO of Onramp, argues that bitcoin’s ~$2T market cap proves product-market fit but single-point-of-failure custody remains inadequate, making multisig essential for long-term holders managing fiat debasement and counterparty risk (Aug 1 | 1:45 min watch).
BEN0WHERE, Product Lead at Bitkey, says the Bitcoin-only multisig wallet is fast-tracking coin control after customer demand, previewing UTXO labeling, freezing, manual coin selection, and individual UTXO recovery options to improve privacy and self-custody control (Aug 2 | 1:42 min watch).
FractalEncrypt, a Bitcoin-only cypherpunk artist, demonstrates how SeedSigner and dice make creating a 12-word bitcoin seed fast and accessible, arguing that self-custody security is practical for families despite fear around technical complexity (Aug 2 | 8:20 min watch).
ICYMI: Wicked shows how to verify dice-roll seed generation on hardware wallets like Coldcard, SeedSigner, and Keystone using offline BIP39 checks, helping users detect flawed RNG, backdoors, and unsafe trust assumptions (Apr 12 | 13:59 min watch).
Jack Mallers, CEO of Strike, urges people to call or text Coldcard users and tell them to migrate funds immediately as low-entropy seeds enable brute-force thefts of hundreds of BTC worth tens of millions (Jul 31 | 4:51 min watch).
Rob Hamilton of AnchorWatch joins Natalie Brunell for an emergency episode on her Coin Stories podcast to explain what's been happening with Coldcard (Jul 31 | 22:55 min watch).
Kelvin Isievwore of Btrust, speaking at Bitcoin++ Open Source Edition, argues that AI can help Bitcoin open-source development through debugging, learning and reviews, but contributors must verify outputs, understand historical context and own every PR to protect security and trust (Jul 15 | 30:53 min watch).
Shantaram of Soapbox, speaking at Bitcoin++ Open Source Edition, argues that open source software should be hackable by default through scriptable apps, AI-assisted customization, and Nostr-based plugin distribution that lets users modify, verify, share, and update software more freely (Jul 13 | 27:39 min watch).
