Today we lost tens of millions of dollars to two separate attacks. Both are worth understanding. They're not the same problem, and they don't have the same solution.
Attack 1: COLDCARD Firmware $38M–$70M in Bitcoin
COLDCARD is one of the most respected Bitcoin hardware wallets on the market. On July 31, 2026, a firmware vulnerability disclosed by Block's security team was actively exploited 594 BTC (approximately $38M at time of disclosure, with totals reported as high as 1,082 BTC/$70M+ as more wallets were drained) disappeared in approximately 25 minutes.
The root cause: a build setting in firmware versions 4.0.0 through 5.0.3 silently disabled the hardware true random number generator. The code that was supposed to check whether the HWRNG was active only verified that the disable setting existed not whether it was actually enabled. With the hardware RNG skipped, seed generation fell back to a software PRNG seeded from the device serial number and internal clock registers both values that are observable and public.
Effective entropy dropped from 128 bits to approximately 40 bits. That makes private keys brute-forceable.
