Hurtiglenker
AI-Discovered Coldcard Flaw Drains $38M in BTC: Leverage Risk Map for Self-Custody Traders
Datasnapshot
Viktige punkter
- •~594 BTC (~$38M) was swept from ~500 Coldcard Mk3 wallets in 25 minutes via a predictable seed-generation flaw; 562 BTC remains unconsolidated and unmoved.
- •Leveraged BTC longs (50x+) face acute liquidation risk if the attacker begins moving the consolidation wallet — monitor on-chain alerts as a primary trigger signal.
- •BTC is trading at $63,679 (24h range: $63,601–$65,391); the $63,601 low is immediate support, with a breach likely accelerating de-leveraging.
- •Counterintuitively, custodial exchanges like Coinbase (COIN) may see net inflows as self-custody confidence erodes — watch for positive divergence vs. miners MARA and RIOT.
- •Coinkite's suggestion that an attacker used AI to find the flaw before the vendor's own AI tooling did signals a new threat vector for the entire hardware wallet and crypto security sector.
According to CoinDesk and Decrypt, approximately 594 BTC (~$38M) was drained from roughly 500 single-signature Coldcard wallets in a coordinated 25-minute sweep between 01:31–01:56 UTC on Friday, span
Event Summary
According to CoinDesk and Decrypt, approximately 594 BTC (~$38M) was drained from roughly 500 single-signature Coldcard wallets in a coordinated 25-minute sweep between 01:31–01:56 UTC on Friday, spanning just three blocks. The stolen funds — 562 BTC — were consolidated into a single address that has not yet moved.
Coinkite, maker of the Coldcard hardware wallet, issued an emergency security advisory confirming a randomness/seed-generation flaw in Coldcard Mk3 devices running firmware 4.0.0 through 5.0.3. A firmware configuration error disabled the hardware RNG, causing devices to fall back to a weak software method using publicly accessible data (serial number, clock registers), making seeds guessable. As reported by Decrypt, Coinkite believes an attacker may have used AI to discover the flaw — noting its own AI-based code review weeks earlier failed to catch it. Emergency firmware patches (5.6.0 for Mk4/Mk5, 1.5.0Q for Coldcard Q) have been released; Mk4, Q, and Mk5 are not affected per Coinkite's analysis.
Leverage Impact Analysis
At the time of writing, BTC is trading at $63,679 — down 0.94% on the day, with a 24h range of $63,601–$65,391. The 594 BTC stolen is a fraction of daily BTC volume, but the *narrative* is the leverage risk.
Scenario 1 — High-leverage long under pressure: A trader holding a 100x BTC perpetual long entered at $65,000 starts with a ~1% margin buffer. BTC has already moved ~$1,389 from the 24h high to current levels. At 100x, that's a 136% move against initial margin — sufficient to trigger liquidation if entry was near the daily high without adequate buffer.
Scenario 2 — Consolidation overhang: The 562 BTC sitting unmoved in a single address represents a visible liquidation threat. If the attacker begins dispersing funds through mixers or exchanges, on-chain alerts could trigger rapid sell-offs, spiking funding rates on perps. Monitor crypto funding rates and positioning signals for confirmation before adding long exposure.
Key leverage risk: Security-driven narrative selloffs tend to be sharp and short-lived. High-leverage traders (50x+) face amplified liquidation risk if the attacker moves the 562 BTC consolidation wallet, as algorithmic traders and monitoring bots may front-run the sell pressure.
For broader context on how hardware wallet exploits fit the self-custody and cross-chain infrastructure risk theme, see our dedicated guide on crypto self-custody and cross-chain infrastructure.
Cross-Market Impact
Crypto proxy equities: Crypto exchanges such as Coinbase (COIN) could see *net inflows* if rattled self-custody users shift to custodial solutions — a counterintuitive short-term positive for exchange AUM. Conversely, MicroStrategy (MSTR), Marathon Digital (MARA), and Riot Platforms (RIOT) face indirect sentiment drag as BTC security fears reprice risk premium across the BTC-correlated equity stack.
Broader crypto market: The flaw is RNG/seed-generation — foundational to any crypto asset stored on affected hardware. This is not a BTC protocol failure but could prompt broader self-custody re-evaluation across ETH and altcoin holders.
Macro/Forex/Commodities: Limited direct spillover. This is a crypto-specific security event with no significant DXY or gold correlation expected unless BTC declines >5–10% and triggers broader risk-off flows.
Trading Considerations
BTC's 24h low of $63,601 is the immediate support level to watch; a sustained break risks testing the $62,000–$63,000 range. The 562 BTC unmoved consolidation address is the primary catalyst to monitor — any movement there should be treated as a volatility trigger. Upside resistance sits near the 24h high of $65,391.
Check open interest and funding rates on CoinUnited.io for real-time positioning signals before sizing into BTC perpetuals. The DeFi protocol exploits resolution guide provides useful context on how exploit-driven selloffs typically resolve.
Trade Bitcoin on CoinUnited.io
Trade BTC with up to 2000xx leverage → | Create Free Account
Ofte stilte spørsmål
It represents a visible, concentrated sell-side threat — if the attacker moves funds toward exchanges, automated on-chain monitoring bots may trigger rapid sell pressure, spiking funding rates and liquidating high-leverage longs near current levels ($63,679). Traders with 50x+ positions should set tighter stops and monitor the consolidation address.
Fortsett Utforskningen
Ansvarsfraskrivelse: Denne briefen er kun for utdanningsformål og er ikke investeringsråd.