Coldcard Hack Exceeds $89 Million as AI Exploits Firmware Flaw

🚩 The Coldcard Hack Passed $89 Million Before Fourth Wave

Coldcard is one of the most trusted hardware wallets in Bitcoin, the kind of air-gapped, offline device serious holders use to keep coins in deep cold storage. Last week, it became the center of one of the largest self-custody thefts ever. Attackers began systematically draining Bitcoin from Coldcard wallets, exploiting a flaw that let them regenerate users’ private keys without ever touching the physical device.

The cause is a firmware flaw, not phishing. A March 2021 Coldcard update drew wallet seeds from a weak software fallback instead of the hardware random generator, collapsing an Mk3’s key security to about 40 bits from the intended 128. That made the keys guessable, which is why coins that sat untouched for years are being swept from wallets that never connected to the internet. One Canadian victim lost 18.25 BTC from keys kept in a safety deposit box, writing that the hardest part was that he “did everything right.”

The theft grew all weekend. What started Thursday as an estimated $38 million drain kept climbing as researchers traced more of it. Galaxy Research now tracks roughly 1,367 BTC stolen, about $88.6 million, across 4,585 addresses in three distinct waves, and flagged the newest wave Saturday. Galaxy is warning that the exploit is ongoing and that every vulnerable device will eventually be emptied, and it has handed roughly 600 suspected attacker addresses to federal investigators. A potential 4th wave of attacks has the damage nearing $114M though researchers say some of the latest attacks may be avoidable by front-running the transaction settlements in the mempool.

Coinkite, Coldcard’s maker, said it has to assume an attacker used AI to comb its open-source firmware for the flaw, and admitted its own AI review of the same code weeks earlier “did not find this bug or anything serious.” Galaxy’s head of research Alex Thorn said the sweeps look programmatic and were “probably orchestrated with a large language model.” Defenders and attackers had the identical tool, and this time it only worked for the attacker.

In barely a week, an AI model cracked a post-quantum cryptography candidate humans couldn’t break, OpenAI’s models escaped a sandbox to breach other companies’ servers, and now attackers have used AI to drain $89 million from wallets sold as the gold standard of self-custody. AI is quickly becoming crypto’s biggest enemy. And one of crypto’s fundamental pillars, self-storage which makes one sovereign and in control of their wealth, is not under serious attack.

🌎 Macro Crypto and Markets

Crypto majors are slightly red; BTC -1% at $62.6k; ETH -1% at $1,840; SOL -1% at $72.30; HYPE +3% at $52.90

Top alt movers include ALGO (+7%), HYPE (+3%) and ENA (+4%)

Oil -6% at $79.50; Gold even at $4,100

Stock futures are green on new Iran peace potential; DOW +1%, Nasdaq +0.35%

Solana printed its 10th straight red monthly candle on July 31

BitGo CEO Mike Belshe publicly challenged Anthropic to hack a real wallet, telling the AI lab to stop with the "we created a hacking monster" demos and posting a BitGo address holding 100 BTC for its models to try to drain

Tether reported $1.5 billion in Q2 net operating profit, up nearly 50% from Q1, with USDT circulation reaching $184.6 billion, a reserve surplus above $4 billion, and gold holdings rising to more than 146 metric tons

Eric Trump’s American Bitcoin reported a $57.2M loss in Q2 while its Bitcoin holdings reached 8,002

Circle landed a New York trust charter from the NYDFS, letting the USDC issuer operate a New York trust company offering digital-asset custody, its second license in weeks after its federal national trust bank approval

South Korea’s second-largest crypto exchange, Bithumb, is targeting an IPO in 2028

Strategy sold $105 million in Bitcoin, funding preferred dividends and a STRC buyback.

Corporate Treasuries & ETFs

The Bitcoin ETFs saw $265M in net outflows on Friday, ending the week with $60M in net outflows overall; the ETH ETFs saw $9M in inflows on Friday and $11M in net inflows on the week

Meme Coin Tracker

Meme leaders were slightly red; DOGE -1%, SHIB -3%, PEPE -1%, PENGU -1%, TRUMP +1%, BONK -3%

Robinhood chain was led by FRONG (+84%) and Cashcat (+20%); Stonkbroker briefly reached $50M before retracing

Solana leaders included CATE (+130%), Manifet (+69%) and Kimchi (+700%); ANSEM -11% at $190M

💰 Token, Airdrop & Protocol Tracker

DEX volumes reached 24% of CEX volumes in July, the highest they’ve ever recorded

Polymarket and Kalshi reached $50B in volume in July, a new ATH

New launchpad Flap flipped Pons in new daily launches on Sunday

🚚 What is happening in NFTs?