Coldcard Hack Explained: What Happened and How to Secure Your Bitcoin Now

<p>The Coldcard exploit drained over $100M from wallets that never touched the internet. How a 2021 firmware bug collapsed seed entropy, what to do with your Bitcoin now, and the AI arms race finding holes faster than teams can patch. Plus: Strategy sold again, Storj went bankrupt, and .bitcoin could become a real domain. <br /><br />In this episode of Good For Bitcoin, Brandon and Kate discuss: </p><ul><li>The Coldcard exploit, explained: a 2021 firmware bug silently swapped seed generation to a weak software RNG seeded by the device ID and the clock, cutting entropy from 128 bits to about 40. Over $100M is tracked stolen on-chain. Dice rolls helped. Stop using Coldcard.</li><li>What now? Brandon's 3-2-1 rule: three wallets, mixed hardware and software, one offsite. Multisig via Bitkey, Casa, or Unchained. Prefer custody? River, Fidelity, BitGo, or AnchorWatch, offering 60 days of free custody as a Coldcard safe haven.</li><li>The AI security arms race: Boltz suspended swaps citing AI-assisted probing, Zeus shut down over a security incident, and BTCPay Server disclosed a critical vulnerability under active exploitation. The red team started by Rob Hamilton and led by calle has scanned 425 projects and filed 1,000+ high or critical findings. OpenSats reimburses the researchers.</li><li>Treasury tracker: Strategy sold 1,637 BTC (~$104M) and bought back $81M of STRC (842,138 BTC held, STRC at $95). Strive +20 (20,020), Block +85 (9,117), American Bitcoin +298 (8,300), OranjeBTC +30 (3,948), Capital B +1 (3,140), Smarter Web +12 (2,712). Cipher Digital sold 470 (646 left); Sequans sold 344 (314 left).</li><li>A French tax agent allegedly sold crypto holders' data from government databases to criminals, linked to a violent home invasion. Kate on the KYC honeypot, and why an offsite multisig key defeats the wrench attack.</li><li>Mempool explorer founder Wiz is filing for the .bitcoin TLD in ICANN's first new gTLD window since 2012. Without a community application it goes to auction; he needs written support from Bitcoin projects.</li><li>Stacks users: POX unstacked every STX position. Restake by around August 12 or miss a cycle of Bitcoin rewards. Leather pools, Xverse, StackingDAO, or the Ryder One all work.</li><li>Also: Storj filed Chapter 11, BitMart is winding down, POAP is shutting down, Fold Bitcoin gift cards hit TikTok at a discount, a solo miner won 3.157 BTC (~$200K), and the Senate punted the Clarity Act to September. Bitcoin already has clarity.</li><li>Follow the show on X: @goodforbtc.</li></ul><p> <br /><b>Hosts:</b> </p><ul><li>Brandon Marshall — <a rel="noopener noreferrer nofollow" href="https://x.com/marshallmixing" target="_blank">@marshallmixing</a></li><li>Kate Parkman — <a rel="noopener noreferrer nofollow" href="https://x.com/katemparkman" target="_blank">@katemparkman</a></li></ul><p> <br /><b>Subscribe &amp; Follow:</b> </p><ul><li><a rel="noopener noreferrer nofollow" href="http://goodforbitcoin.com" target="_blank">goodforbitcoin.com</a></li><li><a rel="noopener noreferrer nofollow" href="https://www.youtube.com/@GoodForBitcoin" target="_blank">YouTube</a></li><li><a rel="noopener noreferrer nofollow" href="https://open.spotify.com/show/5U1THeUKH0kCnUHXwCm76o" target="_blank">Spotify</a></li><li><a rel="noopener noreferrer nofollow" href="https://music.amazon.com/podcasts/da978fdc-d1e9-4df7-acd0-922f254184c5/good-for-bitcoin" target="_blank">Amazon Music</a></li><li><a rel="noopener noreferrer nofollow" href="https://podcasts.apple.com/us/podcast/good-for-bitcoin/id1777877674" target="_blank">Apple Podcasts</a></li><li><a rel="noopener noreferrer nofollow" href="https://pca.st/2jjlopxd" target="_blank">Pocket Casts</a></li><li><a rel="noopener noreferrer nofollow" href="https://anchor.fm/s/f9f164f0/podcast/rss" target="_blank">RSS</a></li></ul>