Coldcard's Five-Year-Old Bug Just Cost Self-Custody Its Self-Esteem 🪦

Losses from a Coldcard hardware wallet exploit have surpassed $100 million, with researchers warning a suspected fourth wave of attacks could push the total toward $130 million as bitcoin trades below $64,000. The breach stems from a firmware flaw introduced in March 2021 that weakened seed generation on affected Coldcard Mk2 and Mk3 devices, allowing attackers to pre-compute candidate seeds and drain funds without ever touching the physical hardware. According to Ripple CTO Emeritus David Schwartz, who has been analyzing the on-chain forensics, the exploit reduced effective entropy on vulnerable builds to as low as 40 bits, far below the intended 128 bits, an error that turned single-signature wallets into sitting targets.

On-chain researchers tracking the sweeps reported that 1,816 BTC, roughly $114 million, has been removed from more than 5,200 addresses since July 30, with observed losses across earlier attack waves totaling about 1,367 BTC (nearly $89 million) from around 4,585 addresses. Galaxy Research puts the tally at 1,596 BTC across roughly 7,300 addresses. Coinkite has patched the firmware, but the fix does not retroactively secure seeds already generated on vulnerable builds, meaning affected users must move funds to freshly generated wallets.

Bitcoin slipped earlier in the session to $62,800, down 1% on the day and 4% over the past week, before recovering to $63,801.62, up 1.6% over 24 hours and reaching as high as $64,160, its highest level since July 31. Ether fell over 1% to $1,858 and has not traded above $1,900 since last week, down 5% on the seven-day view. XRP slipped almost 1% to $1.07, solana dropped half a percent to nearly $73, and dogecoin fell the same to just under 7 cents, while BNB was the only major in the green, flat on the day and up 1.6% on the week. Among the top ten, Hyperliquid's HYPE fell 1% to $52.52 and is down 12.8% over seven days, the worst performer.

The crypto weakness came against a backdrop of falling oil and Treasury yields as President Donald Trump said he had called off a strike on Iran and would open fresh talks on Monday, with Saudi Arabia among the allies pushing for a deal to reopen the Strait of Hormuz. Brent crude futures for October dropped as much as 7.3% to $81.55 a barrel, the 10-year Treasury yield slipped four basis points to 4.69% after hitting its highest since January 2025 last week, and Nasdaq 100 futures and European share futures both gained 0.8%. In Asia, the yen slumped nearly 4% after U.S. Treasury Secretary Scott Bessent confirmed the U.S. joined Japan in coordinated intervention, with bitcoin's 52-week correlation with USD/JPY at minus 0.90 pointing to dollar strength as the larger cross-asset risk.

Adding to the pressure, Strategy (MSTR) sold 1,638 bitcoin between July 27 and Aug. 2 at an average price of $63,957, its third sale of the year and below the company's $75,419 average cost. The Crypto Fear & Greed Index has dropped to "extreme fear" at 25, with spot bitcoin ETFs seeing $61.5 million in outflows last week followed by $170 million in inflows on Monday, while ether ETFs saw $27.4 million in inflows last week and $11.4 million in outflows on Monday. In derivatives, ATOM gained nearly 9% on the day as open interest sat near a record 80 million tokens, even as annualized perpetual funding rates and the 24-hour OI-adjusted cumulative volume delta stayed negative, pointing to a crowded short base hedging the 12% rally in three days off record lows.