coldcard

Alright guys, quick update on the Coldcard wallet hack. White-hat hackers have moved 52.37 $BTC (around $4M+) into a recovery trust. This Bitcoin belongs to people whose funds were affected by the Coldcard exploit.
So what happens now?
The BTC is now controlled by the Crypto Recovery Trust (Wyoming-based). They’ll try to find the real owners and return the funds. But proving ownership might be tricky, because wallet addresses and key verification are strict.$QI
What was the Coldcard exploit?
In simple terms: there was a vulnerability in Coldcard firmware. When generating a wallet seed, the hardware random number generator failed and fell back to a weak software-based RNG. That made seeds predictable, so attackers could potentially guess them and drain funds.$ONDO
White-hats identified some wallets before attackers did and moved the funds to a safe address. Galaxy Digital’s Alex Thorn said around 40% of Wave 2 Bitcoin was rescued by white-hats.
If you’re affected:
If you were a victim of the Coldcard exploit, check the Crypto Recovery Trust website and search your wallet address. If they’re holding your funds, you may be able to start a claim.
My take:
This is a rare positive crypto story where white-hats outsmarted hackers. 52 BTC is only a small chunk (~2.8% of the total exploit), but recovery is moving. Research on the rest is still ongoing.
If you use Coldcard, check your firmware update. Stay safe!
#Bitcoin #Coldcard #CryptoRecovery #BinanceSquare #FedProposesRulesForBankIssuedStablecoins

Just 2.8% of the funds stolen in the largest 2026 hardware wallet hack were routed to a formal return mechanism, and the movement raised legal and technical questions that are still far from being resolved.
White-hat hackers moved 52.37 Bitcoin tied to the Coldcard exploit to an address associated with a recovery fund based in Wyoming, in the United States, on September 21, 2026.
The movement was identified by Galaxy Digital, whose analyst Alex Thorn tracked the transaction in block 967.948, pointing to its origin in the so-called “Wave 2” cluster of the attack. The transferred value represents only 2.8% of the total exploited in the scheme.

August 2026 was a rollercoaster for the crypto space. Kind of a bad one. Just before the start of that month, some unknown attackers managed to take advantage of a bug in the Coldcard hardware wallets to steal up to 2,055 $BTC (~$130 million) directly from users. This is being considered the largest hardware wallet exploit to date. And it was followed by more attacks on Trezor and SafePal, two other major hardware wallet providers. Self-custody is thus called into question for many.
We’ve been told, repeatedly, that our private keys must remain offline, out of reach for hackers and scammers. Therefore, numerous crypto users have chosen to invest in more security and purchase specialized hardware devices to safeguard their coins. Now, among those who chose a Coldcard as this specialized device, several have lost their funds without even doing anything about it, because the attack was completely remote and out of their control.
It feels unfair. But wait, because there are still things to unpack before losing faith in self-custody.
So, What Happened to Coldcard and Company?
The first thing we must understand is that no, crypto networks aren’t just insecure now. The recent attacks weren’t against strong distributed ledgers, but against specific companies and their products. Let’s start with the Coldcard case: the problem came from the way certain devices generated wallet seeds or private keys.
In an average crypto wallet, just “guessing” seeds by applying brute force (many repetitive attempts) is impossible. A 12-word phrase alone has about 340 undecillion possibilities. This implies, as Knowing Bitcoin explains, that “if every computer on Earth tried a billion seed phrases per second, it would take trillions of times the current age of the universe to try them all." Unfortunately, it wasn’t like that for some Coldcard devices.
A software change introduced in 2021 caused certain devices to use a software-based pseudo-random number generator instead of the hardware-based random number generator intended for creating secure seeds. In other words, the wallet's security relied on insufficient randomness. Attackers were able to guess the private keys when they should never have been able to.
Even after applying a firmware fix, those seeds are just not suitable to use anymore. Anyone who has generated seeds on a Coldcard between 2021 and 2026 is advised to withdraw all their funds to a more secure wallet.
What about Trezor and SafePal?
At the very least, no funds were compromised in these two attacks. However, they can be considered equally serious, because personal data and physical addresses were, indeed, leaked. On August 12, Trezor informed that ShipMonk, one of their shipping providers, suffered a severe data breach that exposed the full names, phone numbers, email addresses, and physical addresses of almost 12,000 of its customers.
In the same fashion, barely some days later, SafePal announced the discovery of a bug that could let someone access or track customer order information without having the proper permission. Which some hackers did. Confidential data like names, phone numbers, emails, and physical addresses from almost 40,000 customers was stolen.
It seems "better" than having funds or private keys taken away, but it isn't. With all this information, hackers can easily find customers, carry out targeted attacks, phishing, and even plan "wrench attacks" or physical break-ins at their homes. Indeed, according to Certik, violent physical attacks against crypto users have increased by 33% in 2026, compared to the previous year.
Should we rush to crypto exchanges, then?
According to CMC, "Coldcard Hack Sends Bitcoiners Scrambling for CEXes." So, are they safer for us, after all? Is that a real solution in the long-term for crypto users? The answer isn't that simple. Centralized exchanges, even with tons of investment in security, can and have been hacked.
In 2025, Coinbase, one of the largest exchanges worldwide, suffered the same type of leak as Trezor and SafePal. In previous years, other firms like Liquid, KeepChange, Celsius, and OpenSea faced major data breaches, too. Beyond that, numerous crypto exchanges have been robbed or bankrupted over the years —or they were just scams from the beginning. Mt. Gox, QuadrigaCX, Cryptopia, and FTX are only some of them. Thousands of users globally suffered massive losses from these cases. That’s why this motto is so common in crypto: Not your keys? Not your coins.
However, now that self-custody appears to be threatened, what is the alternative? Where do we run to? You may think that, well, the flaws were limited to certain brands, so we just change brands and that’s it…! And that’s still not the answer. The answer is that nothing and no one is exempt from failure. Self-custody requires more responsibility, while external custody presents a different set of risks. That’s the thing, though.
Neither arrangement removes risk. They put different risks on different sides of the table, and you need to choose which of these risks is “less risky” for your own circumstances. Which benefits do you prefer (i.e., full ownership vs. convenience) and what are you willing to risk for them? Even fiat currencies and banks have their own risks and disadvantages, and their pitfalls are the whole reason why cryptocurrencies exist. Sad, but true.
New Lesson: Don't Put All Your Eggs in One Basket
Decentralize, like crypto networks themselves! If one device, one manufacturer, one backup, one company, or one process can determine whether your entire stash survives, that's a single point of failure you need to fix ASAP, no matter how secure you believe it is. There are several solutions for this.
A simple starting point is backup redundancy, with copies stored in separate locations so one fire, flood, or defective device doesn't wipe out everything. In Obyte, you can create several textcoins with different amounts in them, and store them offline. However, you’ll have to take care of noting down your textcoins (seeds), copying them to different secure locations, and taking care of them to the best of your ability. The only way for self-custody is high responsibility.
For stronger protection, multisignature wallets can require two or more separate keys before coins can be moved. A 2-of-3 setup, for example, uses three keys but requires any two to approve a transaction. That means losing one key doesn’t automatically lock you out, while compromising one key doesn’t give an attacker enough control. You can also spread keys across different devices or manufacturers, reducing dependence on one technology.
In Obyte, you can create a multisignature (multidevice) account in just a few steps to increase your security and, if you wish, include other people as co-signers, not just your own devices.
There’s also value in testing recovery. A backup that has never been checked is a plan on paper. A successful recovery test provides evidence that the plan works. And complexity deserves its own warning label. Every extra passphrase, device, location, and backup adds another thing to remember and maintain.
So, Is Crypto Self-Custody Dead?
No. If anything, the bumps along the road make the idea more mature. Self-custody avoids potential financial censorship and can give people full control, but control comes with homework, from understanding how keys are created to knowing where backups live and what happens when a device fails. To be prepared for a device to fail, even.
Self-custody means taking ownership of the entire security model, not just buying a device with the words “hardware wallet” on the box. Do your own research (DYOR) on every brand, every software, and every process. This is worth repeating: the only way for self-custody is high responsibility!
Originally Published on Hackernoon
#Coldcard #TrezorWallet #DataLeak #cryptohacks #Obyte

The biggest security incident in the crypto space these days is the randomness vulnerability in the Coldcard hardware wallet: about 5,000 wallets, 1,755 BTC stolen, worth over $110 million.
Most reports only say "a vulnerability in random number generation allows the mnemonic to be inferred." But as someone who wants to understand the underlying principles, I looked through a large amount of technical material (Block official analysis, Galaxy Research on-chain tracing, community PoC projects) and broke down the entire attack chain step by step. Here’s what I’m sharing with other equally curious friends.
【First, the most important takeaway】
The hacker didn’t brute-force guess the mnemonic, and he didn’t brute-force guess the private key—both of these live in a 2^256 space, which is physically impossible. What he enumerated was the internal state of the random number generator (PRNG) that produces the mnemonic. That space is only 2^32 (about 4.2 billion).