Coldcard Flaw Exposes 1,080 BTC Theft, Raises Hardware Wallet Security Concerns

A potential cryptographic flaw in Coldcard, a widely used Bitcoin (BTC) hardware wallet, has reignited concerns over device-level security at a time when macro uncertainty and geopolitics are already driving fragile market sentiment.

According to a Korean-language overnight briefing, attackers were able to compromise wallets created under certain conditions after a 2021 firmware update reduced the effective number of possible private keys to roughly 4 billion combinations. The report said the weakness allowed an attacker to steal 1,080 BTC without physically accessing the device, with estimated losses ranging from $70 million to $88.6 million based on prevailing prices. The incident underscores how even 'self-custody' tooling can become a single point of failure if randomness generation—the foundation for secure key creation—breaks down.

While hardware wallets are designed to isolate private keys from internet-connected systems, they still rely on high-quality entropy. If a random-number generator is biased or constrained, attackers can brute-force keys dramatically faster than assumed. Market participants typically treat hardware wallets as the gold standard for custody, so any credible RNG-related finding tends to ripple across the security ecosystem, from device makers to auditors and repository maintainers.

Macro conditions also shifted overnight. The implied probability of a U.S. Federal Reserve rate hike in September fell sharply, sliding from 55% to 44% in about a week after U.S. July nonfarm payrolls came in below expectations and international oil prices softened on hopes that shipping routes through the Strait of Hormuz could normalize. Traders are now looking to next week’s U.S. July Consumer Price Index and Producer Price Index prints for additional direction, with risk assets—including crypto—sensitive to any repricing of the rate path.

On-chain activity highlighted selective accumulation despite choppy price action. One whale address reportedly bought 25,000 Ethereum (ETH) over roughly 34 hours, a position valued at about $46.5 million. Analytics outlet Odaily said the purchases appeared to be executed using a 'TWAP' (time-weighted average price) approach, breaking a large order into smaller fills to reduce market impact and avoid sparking short-term volatility.

In Washington, legislative momentum appeared to accelerate for the CLARITY Act. Bitcoin historian Pete Rizzo said on X on Friday ET that the U.S. Senate majority had moved to invoke a cloture process, sending the bill toward a full Senate vote. The report added that, if it passes, the process would proceed to the House and then to President Trump for signature—an outcome that market participants would likely interpret through the lens of regulatory clarity and compliance expectations for exchanges, issuers, and intermediaries.

Internationally, Brazil’s central bank is preparing tighter controls on large crypto transfers. Reuters reported that from next year, outbound transfers of more than $10,000 in crypto may be delayed by up to 24 hours when routed to foreign virtual asset service providers or self-custody wallets. The measure is aimed at reducing illicit flows, particularly via stablecoins, reflecting a broader global trend of applying bank-style friction to high-risk transfer corridors.

In corporate developments, Circle renewed its USDC partnership agreement with Coinbase ($COIN) without changing its terms, according to the briefing. Circle’s second-quarter revenue and reserve income totaled $701 million, up 7% year over year, and the company reportedly said it does not plan to introduce quarterly dividends. USDC’s distribution economics with Coinbase remain a key variable for the stablecoin market because they influence exchange incentives, liquidity programs, and competitive positioning against other dollar-pegged tokens.

Bitcoin price action remained rangebound, with BTC failing twice to break above the $65,400 level. BlockBeats reported that heavy buy and sell orders clustered around that zone, leaving the market in a 'waiting for a direction' phase—often a precursor to volatility when liquidity thins and one side of the order book finally gives way.

Geopolitical risk, meanwhile, continued to hang over energy markets. CryptoBriefing cited Iran’s Islamic Revolutionary Guard Corps (IRGC) as saying the reopening of the Strait of Hormuz would depend on U.S. conditions being met, keeping uncertainty elevated. For crypto traders, sustained oil volatility can feed into inflation expectations and ultimately rate pricing, creating a second-order channel through which geopolitical shocks influence digital asset demand.

Institutional positioning also drew attention. Morgan Stanley ($MS) reportedly purchased an additional 232 BTC, pushing its total holdings above 6,500 BTC. Odaily characterized the purchase as 'buying the dip' and noted it was the first time the firm increased its holdings in that manner—an incremental data point for investors tracking whether large financial institutions are building exposure systematically or opportunistically.

Decentralized finance faced yet another security incident. Atomic Protocol, a decentralized exchange, reportedly lost 29,984 USDC after an attacker exploited a 'signature replay' vulnerability. Security firm SlowMist said the contract’s signature digest did not bind key parameters—such as position ID, nonce, and chain ID—allowing the same signature to be reused across 21 positions. PANews said the exploit was detected through blockchain security monitoring and estimated the loss at roughly 42.34 million won.

Taken together, the developments paint a market caught between competing forces: softening rate-hike expectations and episodic institutional buying on one side, and elevated security risks—from wallet entropy to DeFi authentication flaws—on the other. For traders and long-term holders alike, the next catalyst may come from U.S. inflation data, legislative progress in Washington, or the direction of geopolitical tension impacting global liquidity conditions.