On July 30, shortly after 1:30 a.m. Italian time, someone began draining wallets. Roughly 594 bitcoin moved in twenty-five minutes - almost $38 million.
Nobody stole a backup or brute-forced a PIN. The attacker worked from home, computing the private keys on paper.
In the following days, further waves brought the haul to approximately 1,816 bitcoin, over $116 million, drained from more than 5,200 addresses.
The keys protecting those funds had been guessable for years. Until that moment, simply, nobody was looking closely enough.
A Bitcoin private key is a number drawn at random from an interval so vast that guessing it by trial and error is impossible. All of self-custody security rests on a single point: that the draw is truly random and unpredictable. The technical name for that randomness is entropy.
Every Coldcard has a chip purpose-built to generate true entropy by measuring the physical noise of the hardware. In March 2021, an error introduced during firmware compilation shut it off without anyone noticing. A security check verified whether a setting existed rather than whether it was enabled: the check passed silently and seed generation fell back to a software generator, a deterministic formula that mimics randomness without actually being random.
The result is a collapse in effective entropy: from the expected 256 bits of security, it dropped to roughly 40 bits on the older Mk2 and Mk3, and to roughly 72 bits on the Mk4, Mk5, and Q. Forty bits is a number of combinations that an ordinary computer can enumerate in a few hours.
Coinkite released the corrected firmware on July 31, the day after the looting began. But for anyone who generated a seed with a Coldcard, updating the firmware is not enough - they must create a new seed on a new wallet and move the funds there.
What failed here was a build error specific to one firmware, not the idea of storing keys offline.
A properly generated seed with 256 bits of true entropy corresponds to 24 words and a number of combinations equal to 2 raised to the 256th power: a figure close to the number of atoms in the observable universe. No existing computer - and none imaginable with today's technology - can enumerate them. A single-sig setup with that entropy remains, now as before, more than secure. For further details, I refer you to the technical deep dive on addresses from fermata #51.
A robust BIP-39 passphrase adds a secret the attacker does not possess, even if the seed were weak - provided it is long, random, and stored with the same care as the seed. A short or predictable passphrase can be brute-forced like everything else.
For advanced users there is multi-vendor multisig: two or three keys out of three, generated on devices from different manufacturers, with different code written by different teams. A single firmware bug can compromise one key, but it cannot reach one born on another company's hardware.
The baseline remains, though, and it should be stated clearly: today a bitcoin in single-sig, on-chain, with a seed of 256 bits born from true randomness, is safe. Everything else is margin - useful for those guarding significant sums or who want to sleep with two pillows - at the cost of increased complexity.
BitBox02 and BitBox02 Nova use five independent sources of entropy:
1) A TRNG (True Random Number Generator) on the secure chip;
2) A TRNG (True Random Number Generator) on the microcontroller;
3) A random value installed on each BitBox02 during factory setup, unique to every device;
4) Random data generated by the device on which the BitBoxApp is used;
5) A cryptographic hash derived from the device password chosen by the user.
Buy a BitBox02 or a BitBox02 Nova for your single-sig wallet or for your multisig. Visit bitbox.swiss/bitcointrain for a 5% discount.
If the code was public and the bug had been sitting there for five years, why did it surface only now?
On July 26, Moonshot AI released the weights of Kimi K3, 2.8 trillion parameters, the largest open-weights model ever published. An open-weights model runs on anyone's hardware, without the guardrails that American providers like Anthropic and OpenAI apply to prevent offensive uses. A researcher reported that K3 resolved 15 critical vulnerabilities that Fable 5 and Codex had refused to touch, precisely because of those filters. The same model, in a security test, escaped its own sandboxed environment to reach the Internet on its own.
A tool like that, aimed at the open-source code of the Bitcoin ecosystem, finds in one night what a human auditor had missed for years.
The bill arrived fast. Boltz, the swap engine that many wallets use behind the scenes to make Lightning work, suspended all swaps indefinitely. The company explained that "attackers now iterate faster than a team our size can find and fix," speaking openly about a paradigm shift for services built on an open stack. Left high and dry were the downstream services - from ZEUS to Aqua to the Bull Bitcoin wallet - that relied on that infrastructure for swaps and Lightning payments.
A few days later Blixt Wallet halted operations. The public explanation remains sparse and, from what I understand by speaking with some insiders, behind it there would be a vulnerability not yet disclosed that affects LND, the most widely used Lightning implementation in circulation. So, if you are reading this and you run a Lightning node on LND, close your channels as soon as possible.
But every offense has a corresponding defense. In response to the disaster, the developer known as Calle and Rob Hamilton of AnchorWatch assembled a Red Team of sixteen people and aimed AI - Kimi K3 and other open models among those used - at the ecosystem's code. The result: 4,962 findings across 390 repositories in 27 and a half hours, 85 of which critical, burning through roughly $40,000 in tokens.
A red team that reports first protects. But the same power, on the other side, hunts for money. And the time that once separated a latent bug from its exploitation has shrunk almost to nothing.
A geography of security emerges from this week. The most complex software - the kind that does more things: swaps, Lightning channels, multi-asset, RWA - is also the kind with more code, and every line of code is one more door to check. As the surface grows, so does what the machine can read and try to break.
The only place this logic cannot touch is the barest: a UTXO on-chain, one key, one signature. It will take time for everything else to harden, and in the meantime the simplest part of the pyramid remains the most solid.
Comments0
No comments yet. Start the conversation.