Author: Jae, PANews
Bitcoin self-custody users have experienced a strong shock.
In the security narrative of the crypto industry, hardware wallets have always been revered as the ultimate fortress for Bitcoin storage: private keys never touch the internet, physically isolated from attack surfaces. However, the security crisis erupted by the renowned Bitcoin hardware wallet Coldcard has torn a huge gap in this belief. On July 30, 1,755.95 Bitcoins, worth over $110 million at market price, were quietly and silently emptied from thousands of addresses, with hackers completing the transfer of major funds 30 hours before the official warning was released.
The breach did not come from external attacks, but rather a fatal flaw buried in the internal foundation for five years. This triggered a chain reaction in the entire crypto market, with the on-chain volume of small Bitcoin transfers skyrocketing to peak levels since the FTX collapse; some self-custody users chose to transfer tokens to large exchanges or Bitcoin ETFs, leading to a crisis of public trust in the security of the self-custody system.
AI identifies a five-year vulnerability in 8 minutes, code flaws break the “security myth” of cold wallets
The seeds of the crisis were sown as early as March 2021.
In the v4.0.1 firmware update released by Coldcard, the development team made a major oversight: during the process of generating cryptographic private keys, they incorrectly invoked a software pseudo-random number generator (PRNG) instead of relying on a true random number generator (TRNG) produced by physical hardware.
A single word's difference led to a world of difference. In cryptography, entropy is the cornerstone of security. Hardware true randomness relies on physical noise and is unpredictable; whereas the “entropy pool” of software pseudo-randomness is limited, and underlying patterns can be deduced. It is this flaw that provided hackers with an opportunity to batch-crack private keys: hackers could systematically enumerate and reconstruct the private keys of the affected addresses, penetrating the entire security link of the product.
A logic error in the code left all private keys generated with specific firmware over the past five years at risk of being brute-forced. This means that single-point hardware devices cannot completely avoid supply chain risks and code logic flaws; the notion of “absolute security” itself is a fallacy.
On-chain traces indicate that the hackers' plundering actions displayed a high degree of automation.
According to Galaxy Research statistics, in the first two waves of attacks, the attackers emptied 1,196 victim addresses in just 41 minutes and transferred over $70 million about 30 hours before Coldcard officially issued an emergency security warning. While most users were still unaware of the risks, they had already completed the first round of harvesting.
Subsequently, the attacks evolved into multiple rounds of sustained plundering. In the latest fourth wave of attack monitoring, hackers drained victim accounts at a rate of up to 13.8 transactions per block and utilized the Replace-By-Fee (RBF) mechanism to ensure transactions were prioritized and packed on-chain, leaving no room for users to take remedial actions.
Even more lamentable is the portrait of the victims. Data shows that the average dormancy time of Bitcoins in the stolen addresses reached 3.18 years, with a median of 3.55 years. Most were long-term hoarders who entered the industry early, firmly believing in the security of cold storage. Years of steadfast faith ultimately fell victim to a five-year lurking vulnerability in the underlying code.
Today, the "weaponization of AI" has enriched hackers' attack methods. Their use of AI to batch-crack private keys indicates that the threshold for automated cybercrime has been further lowered, and future AI attacks targeting outdated codebases may become a normalized threat.
While attackers are weaponizing AI, defenders are also experiencing an efficiency revolution brought about by AI.
After the full-scale attack broke out, developers in the Reddit community utilized Claude Code to perform a comprehensive scanning of Coldcard's open-source firmware code, accurately identifying this hidden pseudo-random number logic flaw in just 8 minutes.
Subsequently, the community further cross-validated the results using the offline environment of Zhipu GLM 5.2 and the open-source model Kimi K3, which consistently replicated the vulnerability scan results.
Notably, the Galaxy Research security team also leveraged Chinese open-source AI to complete a complex clustering analysis of 218 RBF transactions in the hackers' fourth wave of attack, successfully pinning down the “second-hop” destination addresses of the fund transfers.
The community's attempts to trace back with AI have demonstrated that AI-driven automated code audits will significantly compress the risk exposure window for zero-day vulnerabilities. In the future, integrating real-time AI auditing into the development processes of hardware manufacturers and smart contracts will transition from an optional choice to a necessity.
On-chain risk-hedging wave approaches peak of FTX collapse, distributed storage may become mainstream hedging solution
The ongoing fermentation of the Coldcard vulnerability has shaken the collective belief in self-custody security across the entire crypto market and quickly triggered a large-scale wave of risk-hedging on-chain.
According to CryptoQuant monitoring, after the Coldcard hacking incident, the number of active Bitcoin addresses surged from 645,000 on July 30 to nearly 1 million on July 31, reaching the highest daily level since December 10, 2024. On that day, the number of Bitcoin transactions under 1BTC on-chain surged to its highest level since November 2022, with approximately 39,600 BTC transferred, only about 300 coins lower than the record set a few days after FTX filed for bankruptcy.
CryptoQuant's research director, Julio Moreno, pointed out that the Bitcoin community has never faced such intense self-rescue migrations since the FTX collapse.
Once “cold wallets” are no longer safe, there are no bystanders on-chain. When users no longer trust even offline hardware wallets, it signifies that the crypto security system will undergo a foundational reconstruction.
Binance founder CZ expressed that as long as the code is written by humans, vulnerabilities are inevitable. Years ago, Trust Wallet also suffered a loss of $12 million due to a pseudo-random number (PRNG) flaw. It is not wise to blindly trust a single piece of hardware or a long-dormant old wallet; distributed configurations and multi-signature collaborations will be a better solution to reduce the risk of single-point failures.
Bloomberg’s senior ETF analyst, Eric Balchunas, also pointed out that a company with only about five people assuming such a critical Bitcoin storage responsibility is in itself a clear risk signal. In contrast, while users need to incur higher transaction costs, institutions like Coinbase and Ledger, which have larger teams, have greater advantages in security investment and operational capabilities. Bitcoin ETFs also offer another option: investors can enjoy safety protections from large, professional, regulated financial institutions while benefiting from lower management fees.
Joe Burnett, Vice President of Bitcoin DAT (Treasury Enterprises) Strive, stated that self-custody will still exist but the theft of Coldcard will permanently alter users' confidence in self-custody, as a single private key generated by an individual hardware wallet guarding a large amount of Bitcoin poses excessive concentration risk. He believes that as long as Bitcoin itself remains secure, the failure of a certain custodial mechanism will not undermine the underlying monetary system but will force the market to develop better tools, higher standards, and more resilient custodial architectures.
Muneeb Ali, co-founder of Bitcoin L2 Stacks, stressed “not to put all your eggs in one basket”:
20%-30% of BTC should be allocated to ETFs, such as BlackRock's Bitcoin ETF IBIT, for professional custodial and regulatory protection;
40%-50% of BTC should utilize multi-signature solutions similar to Casa, such as a three-key model, where keys are dispersed amongst secure companies, mobile devices, and hardware wallets;
20%-30% of BTC should be used for more advanced self-management solutions, combining different hardware wallets and entropy sources.
As he said, users need to let go of blind trust in a single hardware wallet and turn to cross-vendor multi-signatures, threshold signatures (MPC), smart contract social recovery wallets, and even ETF solutions to eliminate the risk of total collapse due to a single point of failure at the architectural level.
Indeed, the Coldcard incident is destined to become a landmark event in the history of crypto security. The illusion that “cold storage is absolutely secure” has already been pierced by the reality of code flaws.
True security does not lie in a single point’s impenetrable wall but rather in the system's redundancy and resilience. The tuition fee of 1,755 Bitcoins may be high, but only when the industry discards the mindset of “offline is safe” and “hardware is safe” can the security system of crypto assets achieve sustained and robust development amidst ongoing escalation of offensive and defensive confrontations.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
