Morning Minute: The Coldcard Bitcoin Hack Nears $114 Million in Potential Losses

Morning Minute is a daily newsletter written by Tyler Warner. The analysis and opinions expressed are his own and do not necessarily reflect those of Decrypt.

GM!

Today’s top news:

• Crypto majors continue slide despite oil falling; BTC at $62.6k
• Coldcard hack passes $89M in losses
• BitGo CEO challenges Anthropic to hack a BTC wallet holding 100 BTC
• Tether Q2 profits jumped 50% to $1.5B
• CATE soars to $50M and StonkBrokers reach 6.9 ETH, leading onchain action

🚩 The Coldcard Hack Passed $89 Million Before Fourth Wave

Coldcard is one of the most trusted hardware wallets in Bitcoin, the kind of air-gapped, offline device serious holders use to keep coins in deep cold storage. Last week, it became the center of one of the largest self-custody thefts ever. Attackers began systematically draining Bitcoin from Coldcard wallets, exploiting a flaw that let them regenerate users’ private keys without ever touching the physical device.

The cause is a firmware flaw, not phishing. A March 2021 Coldcard update drew wallet seeds from a weak software fallback instead of the hardware random generator, collapsing an Mk3’s key security to about 40 bits from the intended 128. That made the keys guessable, which is why coins that sat untouched for years are being swept from wallets that never connected to the internet. One Canadian victim lost 18.25 BTC from keys kept in a safety deposit box, writing that the hardest part was that he “did everything right.”

The theft grew all weekend. What started Thursday as an estimated $38 million drain kept climbing as researchers traced more of it. Galaxy Research now tracks roughly 1,367 BTC stolen, about $88.6 million, across 4,585 addresses in three distinct waves, and flagged the newest wave Saturday. Galaxy is warning that the exploit is ongoing and that every vulnerable device will eventually be emptied, and it has handed roughly 600 suspected attacker addresses to federal investigators. A potential 4th wave of attacks has the damage nearing $114M though researchers say some of the latest attacks may be avoidable by front-running the transaction settlements in the mempool.

Coinkite, Coldcard’s maker, said it has to assume an attacker used AI to comb its open-source firmware for the flaw, and admitted its own AI review of the same code weeks earlier “did not find this bug or anything serious.” Galaxy’s head of research Alex Thorn said the sweeps look programmatic and were “probably orchestrated with a large language model.” Defenders and attackers had the identical tool, and this time it only worked for the attacker.

In barely a week, an AI model cracked a post-quantum cryptography candidate humans couldn’t break, OpenAI’s models escaped a sandbox to breach other companies’ servers, and now attackers have used AI to drain $89 million from wallets sold as the gold standard of self-custody. AI is quickly becoming crypto’s biggest enemy. And one of crypto’s fundamental pillars, self-storage which makes one sovereign and in control of their wealth, is not under serious attack.

🌎 Macro Crypto and Markets

• Crypto majors are slightly red; BTC -1% at $62.6k; ETH -1% at $1,840; SOL -1% at $72.30; HYPE +3% at $52.90
• Top alt movers include ALGO (+7%), HYPE (+3%) and ENA (+4%)
• Oil -6% at $79.50; Gold even at $4,100
• Stock futures are green on new Iran peace potential; DOW +1%, Nasdaq +0.35%
• Solana printed its 10th straight red monthly candle on July 31
• BitGo CEO Mike Belshe publicly challenged Anthropic to hack a real wallet, telling the AI lab to stop with the “we created a hacking monster” demos and posting a BitGo address holding 100 BTC for its models to try to drain
• Tether reported $1.5 billion in Q2 net operating profit, up nearly 50% from Q1, with USDT circulation reaching $184.6 billion, a reserve surplus above $4 billion, and gold holdings rising to more than 146 metric tons
• Eric Trump’s American Bitcoin reported a $57.2M loss in Q2 while its Bitcoin holdings reached 8,002
• Circle landed a New York trust charter from the NYDFS, letting the USDC issuer operate a New York trust company offering digital-asset custody, its second license in weeks after its federal national trust bank approval
• South Korea’s second-largest crypto exchange, Bithumb, is targeting an IPO in 2028
• Strategy sold $105 million in Bitcoin, funding preferred dividends and a STRC buyback.

Corporate Treasuries & ETFs

• The Bitcoin ETFs saw $265M in net outflows on Friday, ending the week with $60M in net outflows overall; the ETH ETFs saw $9M in inflows on Friday and $11M in net inflows on the week

Meme Coin Tracker

• Meme leaders were slightly red; DOGE -1%, SHIB -3%, PEPE -1%, PENGU -1%, TRUMP +1%, BONK -3%
• Robinhood chain was led by FRONG (+84%) and Cashcat (+20%); Stonkbroker briefly reached $50M before retracing
• Solana leaders included CATE (+130%), Manifet (+69%) and Kimchi (+700%); ANSEM -11% at $190M

💰 Token, Airdrop & Protocol Tracker

🚚 What is happening in NFTs?

• NFT leaders were mixed; Punks even at 32.3 ETH, BAYC -3% at 8.16 ETH, Pudgy +2% at 3.86 ETH; Stonkbrokers soar to 6.9 ETH
• Pitboys (+43%) and Monkeyhood (+200%) led top movers