DIME

Coldcard
2026-08-05 11:34:27

Coldcard RNG flaw tied to four suspected attack waves as scrutiny grows over Bitcoin self-custody risks

A years-old randomness flaw in Coldcard hardware wallet firmware has come under intense scrutiny after several waves of suspicious Bitcoin sweeps were linked by researchers to seeds created under affected software versions. Investigations by Block and Coinkite traced the issue to a 2021 code migration that routed seed generation through a software pseudorandom number generator instead of the intended hardware RNG on some firmware paths, reducing the effective search space of wallet seeds below the design target. Galaxy Research said three suspected attack waves it identified covered 4,585 addresses and 1,367.05 BTC, and on Aug. 3 its researchers flagged a fourth wave that was later updated to about 448.7 BTC across 709 potential victim addresses. Those figures come from on-chain pattern analysis and are not a wallet-by-wallet confirmation of Coldcard victims or final losses. The incident has also reopened debate over custody models. Researchers and market observers pointed to higher address activity, movements from older UTXOs, and inflows to centralized venues after the disclosure, while cautioning that on-chain data alone cannot prove those moves were caused by the Coldcard bug. Coinkite has said users with affected seeds need to generate a new seed in patched firmware or another trusted environment and move funds, because updating firmware alone does not restore the missing entropy in an already created mnemonic.

1400
Coldcard RNG flaw tied to four suspected attack waves as scrutiny grows over Bitcoin self-custody risks
Hyperliquid
2026-08-03 02:03:42

This Week in Crypto: Hyperliquid’s USDC Revenue Share Nears Launch, Solana Inflation Proposal Heads Toward Vote

Crypto traders are heading into the week with a tight list of catalysts centered on Hyperliquid, Solana, and Circle. The biggest item is Hyperliquid’s revenue-sharing arrangement tied to USDC reserves, which is scheduled to begin accruing on Aug. 26, with the first payment set for Oct. 3. According to prior reporting cited in the source, 90% of reserve income generated from USDC deposits on Hyperliquid will be directed to the Assistance Fund for HYPE buybacks. Estimates from Syncracy Capital co-founder Ryan Watkins put that annual buyback flow at $135 million to $160 million based on roughly $5 billion in current USDC balances, with upside if deposits continue to rise. Solana is also in focus as SIMD-0550, a proposal to increase the network’s annual disinflation rate from 15% to 30%, is said by Helius CEO Mert to be nearing a vote. The proposal would keep the terminal inflation rate at 1.5% while shortening the timeline to reach it. Circle, meanwhile, is set to report second-quarter 2026 earnings on Aug. 5 before the U.S. market opens. Investors will be watching USDC circulation growth and whether the Hyperliquid revenue-sharing arrangement begins to pressure margins. Other items on the calendar include the Aug. 4 claim deadline for the Paradex TAP airdrop.

450
This Week in Crypto: Hyperliquid’s USDC Revenue Share Nears Launch, Solana Inflation Proposal Heads Toward Vote
Coldcard
2026-07-31 07:43:46

Coldcard seed-generation flaw linked to 594 BTC drained in 25 minutes

Coinkite has confirmed a seed-generation flaw affecting parts of the Coldcard hardware-wallet line, after on-chain analysts tracked the theft of 594.48 BTC in a burst of transactions completed within roughly 25 minutes. The incident involved 1,324 UTXOs swept through 500 transactions across a three-block window, with the funds taken from about 500 single-signature addresses. Security researchers said the issue traces back to firmware changes introduced in March 2021 that accidentally disabled the secure chip’s hardware random-number generator, leaving key generation to rely on predictable inputs such as a chip serial number and clock registers. Coinkite first focused its warning on the Mk3, then later expanded the affected scope to include older firmware on the Mk4, Mk5 and Q. The company said users should not wait for a firmware update and should move funds by creating a new seed on an unaffected device, verifying backups, testing with a small transaction and then transferring the full balance. Devices including TAPSIGNER, OPENDIME and SATSCARD were said to be outside the affected codebase.

1140
Coldcard seed-generation flaw linked to 594 BTC drained in 25 minutes