Coldcard's $38M (so far) exploit shakes faith in self-custody

4 hours ago

A Coldcard firmware flaw enabled attackers to steal nearly 600 bitcoin worth about $38 million, one of the biggest failures of Bitcoin self-custody.
Security experts warn that the hack underscores growing operational risks in self-custody as cyber threats evolve, including software, hardware, and supply-chain risks.
The incident may accelerate the shift toward regulated custodians and spot Bitcoin ETFs, with some analysts advising investors to hold funds on exchanges or ETFs instead of managing private keys.
Affected users must generate entirely new wallets and move funds, as updating firmware alone does not fix existing vulnerable seeds.
The exploit highlights the tension between Bitcoin's self-custody ideal and the rising technical burden on ordinary investors, pushing them toward professional custodians.

Block's Bitcoin Engineering and Security teams identified vulnerabilities in COLDCARD firmware allowing Bitcoin theft.
Vulnerability stems from an RNG integration error where ngu.random uses a deterministic Yasmarang fallback instead of the hardware RNG.
Affected devices include Mk2/Mk3 v4 (no secure reseed), Mk4/Q/Mk5 (limited 32-bit reseed), while Mk1 and older firmware are unaffected.

Coinkite warns that COLDCARD Mk3 firmware versions 4.0.1 to 5.0.3 may have vulnerable wallet seeds, putting Bitcoin at risk.
The issue does not affect COLDCARD Mk4, Mk5, or Q devices; users with a BIP-39 passphrase face minimal risk.
Users are urged to migrate to a new seed generated on unaffected hardware, verifying backups and testing transfers before moving large balances.

Hugging Face disclosed a hack compromising internal datasets and service credentials.
Attackers exploited a vulnerability via a malicious dataset to escalate permissions and access internal systems.
Stolen credentials have been revoked and rotated; users advised to review their accounts.

A hacker breached Romania's cadastre agency, wiping the entire land registry database after a failed extortion attempt, halting the real-estate market.
Hugging Face was hacked using an autonomous AI agent, stealing internal datasets and cloud credentials, while guardrails hindered their response analysis.
A critical WordPress vulnerability (CVE-2026-63030, wp2shell) allows remote unauthenticated attackers to execute code, affecting versions since last December.

A wave of supply chain attacks targeted popular npm packages (Telnyx, LiteLLM, axios) by injecting trojans to steal sensitive data, exploiting stolen credentials from previous attacks.
Attackers used compromised developer credentials to publish malicious versions, creating a vicious cycle of infections that amplified the reach of the attack.
LLMs are suspected to be accelerants, making it easier to find vulnerabilities and build sophisticated exploits, such as hiding code in audio files.

Block's Bitcoin Engineering and Security teams identified vulnerabilities in COLDCARD firmware allowing Bitcoin theft.
Vulnerability stems from an RNG integration error where ngu.random uses a deterministic Yasmarang fallback instead of the hardware RNG.
Affected devices include Mk2/Mk3 v4 (no secure reseed), Mk4/Q/Mk5 (limited 32-bit reseed), while Mk1 and older firmware are unaffected.

Coinkite warns that COLDCARD Mk3 firmware versions 4.0.1 to 5.0.3 may have vulnerable wallet seeds, putting Bitcoin at risk.
The issue does not affect COLDCARD Mk4, Mk5, or Q devices; users with a BIP-39 passphrase face minimal risk.
Users are urged to migrate to a new seed generated on unaffected hardware, verifying backups and testing transfers before moving large balances.

Hugging Face disclosed a hack compromising internal datasets and service credentials.
Attackers exploited a vulnerability via a malicious dataset to escalate permissions and access internal systems.
Stolen credentials have been revoked and rotated; users advised to review their accounts.

A hacker breached Romania's cadastre agency, wiping the entire land registry database after a failed extortion attempt, halting the real-estate market.
Hugging Face was hacked using an autonomous AI agent, stealing internal datasets and cloud credentials, while guardrails hindered their response analysis.
A critical WordPress vulnerability (CVE-2026-63030, wp2shell) allows remote unauthenticated attackers to execute code, affecting versions since last December.

A wave of supply chain attacks targeted popular npm packages (Telnyx, LiteLLM, axios) by injecting trojans to steal sensitive data, exploiting stolen credentials from previous attacks.
Attackers used compromised developer credentials to publish malicious versions, creating a vicious cycle of infections that amplified the reach of the attack.
LLMs are suspected to be accelerants, making it easier to find vulnerabilities and build sophisticated exploits, such as hiding code in audio files.

Hasty Briefsbeta