If you haven’t heard by now, this week a critical flaw in COLDCARD’s random number generator led to the theft of more than 1,300 BTC from Bitcoiners who believed they had done everything right.

If you still have bitcoin secured by a seed phrase generated on a COLDCARD device, we strongly recommend moving your funds to a newly generated wallet on a different hardware device or, if necessary, a trusted exchange as soon as possible.

If you’re looking for immediate next steps, check your inbox for the email we sent on Sunday, which outlines the actions we recommend and includes educational resources to help you navigate this situation.

There will be many lessons to take away from this incident. It highlights the value of independently generated entropy and, for larger holdings, multisignature setups using hardware wallets from multiple vendors.

Our hearts go out to everyone who lost bitcoin in this attack. Bitcoin itself was not compromised, but this event has shown that some of the assumptions many of us held about hardware wallet security deserve to be reexamined.

One bright spot has been the response from the Bitcoin community. Over the past 72 hours, developers, researchers, companies, and everyday Bitcoiners have worked together in a remarkable effort to understand the vulnerability, protect users, and help victims.

We will learn from this, improve our practices, and emerge stronger. Self-custody remains one of Bitcoin’s greatest strengths, but this week reminded us that it requires constant vigilance.

Other top stories from the week include:

Imagine waking up, opening your phone, and stacking free Bitcoin in under 30 seconds.

That’s exactly what SatsDrop from Rhino lets you do.

Every day, you’ll get three free drops. Just tap, watch the chip fall, and earn real Bitcoin directly to your Rhino account. No purchase necessary. No catch. Just sats.

Each drop gives you a chance to win up to 10,000 sats instantly. And when a SuperDrop goes live, things get even more interesting, with bonus drops, multipliers, and jackpots of up to 100,000 sats from a single play.

Instead of doomscrolling X, spend 30 seconds stacking sats.

Sign up using the link below and start dropping today. Then use code BITCOINNEWS when you create your Rhino account to unlock an extra $10 in free Bitcoin.

This has been one of the saddest weeks I’ve experienced in Bitcoin in a very long time.

As you read this, it has been three days since the attack began. If you used a COLDCARD to generate your wallet, I strongly encourage you to check your balance, move your funds to a newly created wallet on a different hardware device, and reevaluate your security setup.

The week began on a much lighter note. Most of the attention was focused on the CLARITY Act, with even U.S. Treasury Secretary Scott Bessent quoting Satoshi Nakamoto while urging the Senate to pass the legislation.

It began with a few posts from people reporting that their funds had disappeared. The first one I personally saw was on Reddit, where someone claimed their entire wallet had been swept despite apparently doing everything right.

At first, it was easy to assume the victim had made a mistake. Surely it was human error. Even as more people reported nearly identical incidents, Coinkite founder NVK continued to reassure users that there was no reason to panic.

Unfortunately, there was every reason to panic. What followed became one of the most devastating moments I’ve experienced in my Bitcoin journey.

Within hours, both Coinkite and Block announced they were investigating the incident. Their initial findings pointed to a vulnerability in seed generation on COLDCARD Mk3 devices, potentially exposing wallets created without sufficient dice entropy or a BIP-39 passphrase.

I immediately checked my own funds. Thankfully, they were still there.

But as the investigation unfolded, the scope appeared to widen. Researchers warned that wallets with weak BIP-39 passphrases could also be vulnerable, and concerns grew that the issue might not be limited to the Mk3. Evidence suggested wallets generated on affected COLDCARD firmware dating back to 2021 across multiple models could also be at risk.

 was fortunate not to lose any funds, but the fear and uncertainty were overwhelming.

I was convinced I had done everything right. I held my own keys, secured by a hardware wallet that had long been considered one of the safest options in Bitcoin.

COLDCARD was “Bitcoin only.” That was supposed to mean a smaller attack surface, fewer moving parts, and fewer opportunities for critical vulnerabilities.

Then the stories started appearing on X.

One after another, people claimed they had lost their life savings.

In those moments, I could not stop thinking about how fortunate I had been to move my funds in time. Perhaps the difference was only a matter of days, hours or even minutes.

My heart goes out to everyone affected by this attack. It is heartbreaking to see people lose their savings despite believing they had done everything right.

Many longtime Bitcoiners, along with countless newcomers, will look back on this event and wonder whether self-custody is truly worth the responsibility, or whether they would be safer trusting an exchange, a custodian, or an ETF instead.

As devastating as this incident has been, I still believe self-custody is one of Bitcoin’s greatest innovations. It gives individuals the ability to truly own and control their money without relying on anyone else.

But this week has also been a sobering reminder that with that freedom comes responsibility, and that even the most trusted tools can fail.

My biggest takeaway is that we should never rely on a single source of entropy when creating a Bitcoin wallet. Adding independently generated entropy, such as properly executed dice rolls, can reduce dependence on any one device or manufacturer.

Another approach is to distribute vendor risk through a multisignature setup using hardware wallets from different manufacturers. That introduces additional complexity, but it also avoids placing complete trust in a single device, company, or implementation.

Self-custody does not mean eliminating trust entirely. It means understanding where that trust remains and trying to reduce the number of single points of failure.

Once again, my heart goes out to everyone affected. We will learn from this, improve our security practices and come back stronger.

Keep stacking.
- Bam