A 5-year-old bug has now drained $114M

Monday, August 3, 2026

A solo bitcoin miner struck block 960,804 early Monday, netting a reward of 3.157 BTC worth approximately $199,300 — the second solo win in just three weeks and the 13th such block claimed this year, defying the statistical odds that favor large mining pools. The upbeat headline is tempered by the broader mood. The Coldcard hardware wallet exploit, now entering its fifth day, has grown to an estimated $114 million in losses across four waves and more than 5,200 addresses, with a fourth wave still active Monday. Unlike earlier sweeps, the latest transactions use bitcoin’s replace-by-fee feature, meaning victims who spot their address in the mempool may still have minutes to outbid the attacker. The incident has triggered a visible behavioral shift: the number of BTC sending addresses spiked on Friday to levels not seen since early 2024, with the exchange reserve rising to 2.718 million BTC. Bitcoin is trading below $63,000 and below its 200-week simple moving average — a level Strategy, the world’s largest publicly listed bitcoin holder, has flagged as a key long-term signal. The 50- and 100-week averages have also crossed bearishly, confirming the path of least resistance is lower. On the regulatory front, the Senate left the Clarity Act off Monday’s agenda, leaving just five days of scheduled session before the August 10 recess. Stay alert!

Read today’s full report →

Market snapshot

As of 9am EST

Asset

Price

24h

BTC

$62,520.08

+0.06%

ETH

$1,839.56

−1.04%

SOL

$72.39

−1.44%

XRP

$1.06

−1.77%

Prices approximate. Visit coindesk.com/price for live data.

What matters today

Tech

Story 1 of 2

Major bitcoin wallet flaw drains 594 BTC in 25-minute sweep.

Roughly 594 bitcoin — worth approximately $38 million — was swept from around 500 separate wallets between 01:31 and 01:56 UTC on Friday in an attack traced to a flaw in how Coldcard hardware wallets generated their cryptographic keys. The attacker moved 1,324 chunks of bitcoin across 500 transactions inside a three-block window, then consolidated 562 BTC into a single address. The vulnerability was introduced in Coldcard firmware 4.0.0 in March 2021: a build setting caused devices to skip their hardware randomness generator and fall back to a software substitute seeded from the chip’s serial number and clock registers — none of which are secrets. Block’s Bitcoin engineering team disclosed the flaw publicly because exploitation was already under way. Coinkite warned users who generated a seed on an Mk3 running firmware 4.0.1 or later and stated that Mk4, Q, and Mk5 appear unaffected. The exposure extends beyond wallet seeds to paper wallet private keys, seed-splitting masks, device cloning keys, and Key Teleport transfers.

Tech

Story 2 of 2

Coldcard wallet losses may near $114 million as possible fourth sweep emerges.

A fourth wave of sweeps targeting bitcoin held in Coldcard-generated addresses began early Monday and was still running hours later, with researchers estimating the attacker has moved about 1,816 BTC — roughly $114 million — from more than 5,200 addresses since July 30. Unlike the earlier three waves, the latest transactions use bitcoin’s replace-by-fee feature, meaning victims who spot their address in the mempool may still be able to outbid the attacker and move their funds first. Galaxy Research’s Alex Thorn, who flagged the wave, advised users to check funds, move anything off an affected device, and bid the fee up. The pattern covers blocks 960,778 to 960,792, with 218 transactions hitting 462 victim addresses — roughly 45 times the normal rate. None of the four waves touched multisignature setups, consistent with the flaw affecting only single-key seeds. Coinkite has released emergency firmware for all affected models; users who generated a seed on the flawed software should move funds to a wallet address created with a fresh seed immediately.

CoinDesk Disclosure: The information contained in this newsletter, and any information linked through the items contained herein, is not intended to provide sufficient information to form the basis for an investment decision. You should seek additional information regarding the merits and risks of investing in any cryptocurrency or digital assets.

L1.co Disclosure: This material is for informational purposes only, and the content contained herein should not be considered investment advice or a solicitation, offer, or recommendation to sell or buy any asset, strategy, or product. Investing in digital assets involves a high degree of risk, including the loss of principal.