A critical firmware vulnerability in Coldcard hardware bitcoin wallets by Coinkite allowed attackers to steal about 1,367 BTC (valued at up to $89 million) from over 4,500 addresses in a series of coordinated attacks in the past week.

An initial coordinated sweep drained 594 BTC (~$38 million) from roughly 500 wallets in just 25 minutes, targeting the highest-value dormant accounts. The attack expanded to 1,082 BTC across 1,196 addresses within a 41-minute window, with attackers using elevated transaction fees to ensure rapid confirmation.

Cumulative losses reached 1,367 BTC across 4,585 addresses, with attackers continuing to exploit the vulnerability as other actors joined in.

The flaw, present since March 2021, caused affected devices to generate wallet seeds with significantly reduced entropy—40 bits for Mk3 devices and 72 bits for later models—instead of the intended 128 bits, by silently falling back to a predictable software-based random number generator instead of the hardware RNG.

A 2021 code commit introduced a library (`libngu`) that used a preprocessor check which only verified if a macro was defined, not if it was enabled. This caused the device to bypass its secure hardware random number generator.

The fallback software generator relied on non-secret data like chip IDs and internal clock values, creating a search space small enough for attackers to brute-force private keys offline.

Mk3 units running firmware 4.0.0 or later were most severely impacted. Mk4, Mk5, and Q devices were also vulnerable, though with slightly higher entropy (~72 bits).

The bug remained undetected through five years of updates and AI-assisted audits, as the generated seeds appeared valid but lacked true randomness.

The stolen Bitcoin remains largely unspent, held in a small number of attacker-controlled addresses, with analysts suggesting this is a deliberate strategy to avoid capture by authorities and triggering immediate market panic.

Galaxy Research identified about 600 suspected attacker addresses and reported them to federal investigators, compliance firms, and cybersecurity teams. Block, Jack Dorsey’s company, published an independent technical analysis confirming the RNG flaw.

Coinkite released patched firmware and urged users to transfer funds to new, secure wallets. Crucially, users were warned that updating the device does not fix old seeds; users must generate entirely new seeds using the updated firmware.

In an update on X Tuesday, Coinkite wrote in part: "We understand there is real anger at this moment. Users have suffered real losses, and for those impacted, no public statement is enough.

"We continue to support affected customers directly and urge others to reach out to any other users they are aware of who may be affected. Urgently: if your seed was generated with our affected firmware, without at least 50 independent, private dice rolls, and your funds aren't protected by a strong, unique BIP-39 passphrase, move those funds to a new wallet now.

"As independent researchers have publicly corroborated, this firmware bug appears to have lived at a boundary between two unrelated submodules, not in the parent code, and not in the cryptographic or Bitcoin-specific logic that are the subject of most internal and third-party reviews.

"Because the flag check looked correct, the bug silently went unnoticed, and its potential impact grew with every release.

"We believe it’s important for the broader ecosystem to understand how this bug arose, and why it evaded detection, so they can avoid similar consequences.

"We know there are questions about our own use of AI in code review. We'll cover this fully in our post-mortem, but given the active investigation right now, here's what we can say immediately.

"We've run AI-assisted review against our critical codebases, including in the weeks before the exploit. It did not catch this vulnerability. Since the incident, we've also tested our code against frontier models, including Kimi K3, Claude Fable, and Codex 5.6. None of them caught it.

"It's a reason for us, and anyone else relying on AI tools, to be specific about what it currently catches and what it might not."

The ColdCard incident highlighted that hardware wallet security is only as strong as its entropy generation, prompting competitors like Ledger and Trezor to reaffirm the security of their own TRNG implementations.

A senior US Central Command (CENTCOM) intelligence officer reportedly sent an internal email last Wednesday, soliciting "creative and unconventional" strategies to pressure and punish Iran, signaling a strategic impasse in the ongoing conflict.

This crowdsourcing effort emerged as President Donald Trump’s administration faced limited options following weeks of airstrikes that failed to compel Tehran into a negotiated settlement or secure safe shipping through the Strait of Hormuz.

“We are looking for new creative and unconventional ways to pressure and punish Iran,” read the message from the CENTCOM intelligence branch officer. In a statement responding to the leaked email, CENTCOM spokesperson Capt. Timothy Hawkins did not deny the message, explaining that CENTCOM Commander Adm. Brad Cooper routinely solicits ideas across all ranks to encourage operational innovation.

“U.S. Central Command has a long history of thinking and working in innovative ways,” Capt. Hawkins said in the statement. “Admiral Cooper, in particular, reaches out to members of our great team, regardless of rank, to achieve the highest levels of operational performance possible.” However, military officials described the broad solicitation of ideas via email as unusual given the sensitivity of ongoing operations.

Intelligence assessments from the CIA and Defense Intelligence Agency reportedly concluded that the current bombing campaign is unlikely to shift Iran’s negotiating position. Joint Chiefs of Staff Chairman Gen. Dan Caine has acknowledged that air power has limits, particularly regarding deeply buried nuclear facilities like Pickaxe Mountain which conventional bombs cannot fully destroy.

Trump is weighing difficult alternatives, including a sustained bombardment of Iranian missile capabilities (hampered by dwindling US interceptor stocks), symbolic "fireworks" strikes, or a ground invasion. A ground operation which is very unpopular, would risk destroying Trump's presidency, violating his 2024 core campaign promise to avoid prolonged foreign wars and would require significant US troop deployment.

Eighteen US service members have been killed in the fighting, with hundreds more wounded. Officials have raised concerns that striking Iranian infrastructure, such as bridges or desalination plants, could cause high civilian casualties and further destabilize the region.

The internal email preceded a threat by Trump to launch a massive new round of strikes. However, Trump called off the attack over the weekend following direct de-escalation interventions from key regional allies, including the United Arab Emirates, Qatar and Saudi Arabia Crown Prince Mohammed bin Salman. The president also claimed the Iranians begged him to put off the attack, a claim denied by officials from the Persian nation, Monday.

In a Truth Social post Monday, Trump accused Iran’s leadership of being “unbelievably duplicitous” and insisted peace negotiations were under way “whether” the regime “wants to admit it or not” after Tehran publicly denied his claim of direct talks.

Trump had told reporters on Air Force One on Sunday, that negotiations with Iran would begin “tomorrow afternoon” and declared a peace agreement was “imminent.” The president also said he had shelved plans for what he described as “the biggest attack since World War II” after appeals from Iran and regional partners.

As the direct U.S.–Iran negotiations remain stalled, Iranian officials confirmed ongoing negotiations with Oman regarding the management and transit mechanics of the Strait of Hormuz.

Proposals brokered through Omani mediation aim to establish new defined shipping channels, grant a 60-day toll-free passage period through the strait, and end Washington's naval blockade in exchange for halting attacks on Persian Gulf shipping lanes. Iranian Foreign Ministry spokesperson Esmaeil Baghaei noted these talks center on securing safe transit mechanisms following the breakdown of earlier ceasefires.

In the lengthy post on Truth Social on Monday, Trump reacted to a statement from Baqaei earlier in the day, who had rejected the idea that the regime was negotiating with the United States.

Trump wrote, "Iranian Leadership is unbelievably duplicitous! They ask for a meeting, some would say 'beg,' talks begin, with more scheduled in the immediate future, and they say, openly and proudly, that they’re not having any discussions, that nothing is being talked about, and they’re only dealing with 'Oman.'

"They then go on to give their usual blather in saying, the Strait of Hormuz will be operated powerfully by them, when it is already completely controlled by the United States Navy and our 'Blockade' or, as some say, 'The United States Wall of Steel!' Nothing gets through to Iran, unless we want it to, and nothing will get through, unless a Deal, or Total Surrender, is accomplished. Whether Iran wants to admit it or not, we are, in fact, talking of a solution to a problem that they have caused, for decades. It is very simple, IRAN WILL NEVER HAVE A NUCLEAR WEAPON!"

President Donald Trump has called off planned U.S. military strikes on Iran. In a Truth Social post early morning UTC Sunday, he claimed Iran and other Middle Eastern countries asked him to cancel the planned operation, after the “perimeters of a deal” were agreed to.

Trump wrote, "The U.S.A. is locked and loaded and ready to go against the Islamic Republic of Iran, at levels of Military Terror, Strength, and Power not seen since World War II. Despite this, we have just been asked by Iran, and other Middle Eastern Countries, to hold off any attack in that the perimeters of a deal has been agreed to.

"This would include the Immediate, Complete, and Total OPENING OF THE HORMUZ STRAIT, and an end to Iran’s nuclear threat. Based on this request, I have agreed, for the future benefit of the WORLD and, likewise, the survival of a successful and prosperous Iran, to cancel the attack, subject to being able to rapidly make a DEAL.

"The Country of Israel joins me in this commitment. Get to work, everybody, and get it DONE. Thank you for your attention to this matter! President DONALD J. TRUMP."

The announcement came a day after he threatened that the U.S. military will pummel Iran, and reportedly target the country's civilian infrastructure. “We will be hitting them very hard,” Trump said during a televised press conference Friday at Camp David. “And you know at some point, they’re going to say, ‘We just can’t take it anymore.’”

Trump's reversal comes amid report that Gen. Alexus Grynkewich, head of U.S. European Command (EUCOM), reportedly privately warned the Pentagon that he lacks sufficient naval forces to protect Israel from Iranian ballistic missiles, stating he would be forced to prioritize the U.S. homeland without an additional Navy destroyer.