[coldcard]

August 24, 2026

• A critical RNG flaw in Coldcard hardware wallets was disclosed by Wizardsardine, with a breakdown of what went wrong, which devices and seed-generation paths are affected, and what owners should do (Wizardsardine). · Vulnerabilities & Exploits

in Four Days Dark: Iran-Linked Intrusion Knocked a UK Power Plant Offline

August 2, 2026

• The Coldcard drain is still live and growing. What began earlier this week as reporting on a COLDCARD firmware/entropy weakness (earlier coverage) has escalated into one of the largest self-custody thefts on record — The Hacker News reports attackers drained roughly $70M in 41 minutes from addresses generated with weak entropy (The Hacker News). Trackers logged a second wave of 1,158 BTC from 2,673 addresses and a third wave pushing estimated losses past $88M (@DarkWebInformer). Galaxy researchers say the campaign is continuing and that ~600 attacker-linked addresses have been reported to investigators, urging Coldcard single-sig holders to move funds immediately (@glxyresearch). Note that the surrounding "timed to a chain fork / Clarity Act" theories circulating on X are unsubstantiated speculation. · Threat Activity

in Coldcard Wallet Theft Climbs Past $88M as Attackers Drain Weak-Entropy Addresses in Waves