Connect with us

DeFi

Coldcard Hardware Wallet Exploit Drains Over $100 Million in Bitcoin

Published

on

A multi-year firmware flaw in Coinkite’s Coldcard Bitcoin hardware wallets has enabled attackers to reconstruct private keys offline and drain funds from thousands of addresses, with losses estimated in the $116–$130 million range.

The vulnerability stemmed from a March 2021 firmware build configuration (affecting versions roughly 4.0.1 through later releases) that caused seed generation to fall back on a weak software pseudo-random number generator instead of the device’s dedicated hardware entropy source. This reduced effective randomness from the intended 128 bits to as little as ~40 bits on older Mk2/Mk3 models and ~72 bits on later Mk4, Mk5, and Q models—making many seeds computationally feasible to brute-force without physical access to the devices.

Attack waves began around July 30, 2026. The largest early sweep moved roughly 1,082 BTC from more than 1,100 addresses in about 41 minutes. Subsequent waves expanded the damage. Independent on-chain analysis by firms including Galaxy Research and TRM Labs has tracked confirmed or high-confidence losses of approximately 1,596–1,816 BTC (roughly $100–$116 million at prevailing prices), with a suspected additional wave potentially pushing the total toward ~2,000–2,055 BTC, or around $130 million. Thousands of addresses across multiple waves were affected.

Coinkite issued emergency firmware patches and urgent migration guidance. Updating the firmware prevents new weak seeds from being generated but does not repair existing seeds created on vulnerable builds. Affected users must generate entirely new seeds on patched firmware (or using strong alternative entropy methods such as physical dice rolls) and migrate funds immediately. The company has emphasized that products outside the affected Coldcard seed-generation path, such as TAPSIGNER, OPENDIME, and SATSCARD, are not impacted by this specific flaw.

On-chain tracking has shown that the majority of stolen Bitcoin has so far remained largely unspent or only lightly consolidated at attacker-controlled addresses, with limited evidence of extensive mixing or rapid laundering in the initial days after the sweeps. Multiple distinct attacker footprints have been observed, with some reports citing more than a dozen separate operators exploiting the same vulnerability.

The incident ranks among the larger crypto security events of 2026 and has intensified scrutiny of hardware-wallet entropy sources, firmware auditing practices, open-source review processes, and broader assumptions around pure self-custody. Security researchers and industry voices have reiterated long-standing advice on layered defenses, including multi-signature setups, diversified custody approaches, and rigorous verification of seed generation methods.

Users who generated seeds on Coldcard devices during the vulnerable firmware window are strongly advised to treat the situation as urgent, verify their setup against Coinkite’s latest advisories, and move funds to securely generated new wallets if any risk exists. The event continues to be monitored by on-chain analytics firms and law-enforcement investigators.

DeFi

Chainlink Partners with Bottomline to Enable Cross-Chain Payments for 600+ Banks

Published

on

Chainlink just plugged itself into a pipe most people have never heard of — and that pipe already moves more money than most blockchains will see in a decade.

On September 3 the oracle network said it had entered a strategic partnership with Bottomline, a top-three Swift service provider, to open cross-chain and cross-border payment rails for Bottomline’s 600-plus bank customers. Bottomline’s platforms handle more than $16 trillion in payments a year. The firm also counts about 1,200 financial institutions and 10,000 businesses. One compilation put daily traffic near 10 million payments and estimated that roughly 15% of international Swift cross-border traffic already touches Bottomline’s stack. The banks keep sending ISO 20022 messages. Chainlink sits underneath and talks to chains.

That is the whole pitch. Do not rip out Swift. Add a settlement option.

What actually gets built

Two Chainlink products do the work.

CCIP, the Cross-Chain Interoperability Protocol, moves messages and tokenized value across supported public and private networks. It has been live since July 2023 and now spans more than 60 chains. CRE, the Chainlink Runtime Environment, orchestrates the workflow from the bank’s existing instruction through on-chain settlement and back — compliance checks, routing, confirmations — so the core banking system does not have to learn a new chain every quarter. Access is supposed to be a single, network-agnostic connection rather than a custom integration per ledger.

In practice a treasury desk can keep typing the same Swift message it types today. If the receiving side, or the bank’s own policy, wants the value to land as a token on a permissioned chain or a public one, CCIP and CRE handle the hop. Correspondent accounts, weekend gaps, and T+2 FX still exist until someone actually settles on-chain. The partnership is the adapter, not a replacement for the correspondent system.

Neither firm disclosed how many of the 600 banks will turn the feature on first, what volumes will run, or when production traffic starts. Several reports framed the work as still at proof-of-concept. Treat “600 banks” as the addressable base, not a live user count.

Why Bottomline is the interesting logo

Swift itself connects more than 11,500 institutions. It does not settle. It messages. The bureaus that sit between those messages and bank back offices are where integration actually happens. Bottomline, owned by Thoma Bravo, is one of the three largest of those bureaus. Wiring Chainlink there is different from signing a memorandum with a single money-center bank. It is a distribution deal: one integration, hundreds of potential endpoints, without asking each bank to stand up its own oracle stack.

That is also why the $16 trillion figure is easy to misuse. It is Bottomline’s existing payments book, almost all of it still fiat rails. None of that volume automatically becomes CCIP volume. The option is what changed. Banks that already trust Bottomline for Swift connectivity now have a vendor-supported path to public and permissioned chains that does not require a second operations team.

Where this sits on Chainlink’s bank map

The Bottomline announcement is not Chainlink’s first institutional payment story. It is the widest distribution story.

Project Pangea already groups more than 50 banks in Europe and South Korea — including the Qivalis euro-stablecoin cohort and Korea’s UniKA alliance — targeting near-real-time, stablecoin-based FX settlement in a corridor of about $150 billion in trade, with banks still speaking Swift and ISO 20022. Chainlink has also put CCIP in front of names such as JPMorgan, ANZ, UBS Asset Management, and the Hong Kong Monetary Authority. Data products — including U.S. official economic releases delivered on-chain — and state-level stablecoin work sit on the same enterprise calendar. Swift’s own head of strategy, Jonathan Ehrenfeld Solé, is slated to speak on digital-asset adoption at Chainlink’s Link:NYC event on October 29. The bureau deal and the Swift conference circuit are the same campaign: meet the bank where the message already lives.

LINK traded up about 6–7% on the news, around the low $12 area in some prints. Token reaction is not implementation. Fees from a live payments workflow would be the fundamental. Those have not been published.

What still has to be true

Three gaps sit between a press release and a cheaper wire.

First, production. A path for 600 banks is not 600 banks sending value on CCIP. Watch for a named pilot, a corridor, and a first live settlement date. Second, compliance. Cross-chain does not erase sanctions screening, travel-rule data, or the fact that a public-chain hop is a different risk committee conversation from a private one. CRE can orchestrate that. Banks still have to approve it. Third, the Swift question. Swift is running its own digital-asset experiments. A top bureau plugging in Chainlink is complementary until it is competitive. How those two interoperability stories coexist will matter more than which logo won Thursday.

If the integration ships, the efficiency case is straightforward: fewer nostro balances, fewer cut-off times, programmable settlement next to the same ISO 20022 instruction the bank already files. That is the RWA-and-payments thesis in a sentence — tokenized value moving on the message the industry already standardized. ICE–tZERO, LSEG–Payward, and DTCC’s Stellar hook are the securities version of the same idea. Bottomline–Chainlink is the payments version.

Until a bank posts a hash next to a Swift MT or pacs.008, call it infrastructure optionality. For an oracle network that has spent years trying to become the default middleware between those two worlds, optionality at $16 trillion of existing flow is the point of the announcement. The next update that matters is not another logo. It is a volume number.

Continue Reading

DeFi

DeFi4 hours ago

Chainlink Partners with Bottomline to Enable Cross-Chain Payments for 600+ Banks

Chainlink just plugged itself into a pipe most people have never heard of — and that pipe already moves more...

Crypto1 day ago

Binance Completes 48th Monthly LUNC Burn as BNB Chain Marks Six Years

Binance opened September the same way it has opened most months since the Terra collapse: by sending LUNC to a...

DeFi1 day ago

Macro Pressure Intensifies: Rising Yields, Oil Spike, and Fed Hike Odds Weigh on Risk Assets

The August risk rally ran into a wall that does not care about ETF streaks. A synchronized bond sell-off, an...

DeFi2 days ago

CME Overtakes Other Venues to Become Leading XRP Futures Market

XRP’s rally did not rebuild leverage. It moved the leverage that remained onto Chicago. CME Group is now the largest...

DeFi2 days ago

London Stock Exchange Partners with Kraken Parent to Tokenize Top UK Stocks

London is putting its blue chips on a chain. It is not putting its shareholders on that chain — not...

DeFi2 days ago

NYSE Owner ICE Bets on tZERO to Advance Tokenized Securities Infrastructure

The owner of the New York Stock Exchange just bought another piece of the on-chain plumbing. Intercontinental Exchange said Monday...

Bitcoin3 days ago

Spot Crypto ETFs Attract Over $2 Billion in Weekly Net Inflows

The institutional bid did not leave with Friday’s bitcoin outflow. It just spread out. U.S. spot crypto ETFs took in...

DeFi3 days ago

Tokenized Stock Volume Jumps 415% in a Month as Holder Base Explodes

Tokenized stocks just produced the kind of on-chain print that used to belong only to memecoins and perpetual futures. Monthly...

Bitcoin5 days ago

Fed Chair Warsh’s Jackson Hole Remarks Pressure Risk Assets

Federal Reserve Chair Kevin Warsh did not need a rate announcement to reprice the week. He needed one sentence. Speaking...

Bitcoin5 days ago

Bitcoin ETF Inflow Streak Ends Amid Hawkish Fed Commentary

The most important bid under Bitcoin’s August rally just blinked. U.S. spot Bitcoin ETFs recorded about $202 million in net...

Advertisement

Trending