Throwback: The Coldcard vulnerability originated from firmware 4.0.1 in March 2021. A compilation configuration error caused some devices to use weak random numbers to generate seeds. It went unnoticed for five years and started being exploited in batches by the end of July 2026, resulting in the theft of approximately 1,816 BTC.