DeFi
Coldcard Hardware Wallet Exploit Drains Over $100 Million in Bitcoin

A multi-year firmware flaw in Coinkite’s Coldcard Bitcoin hardware wallets has enabled attackers to reconstruct private keys offline and drain funds from thousands of addresses, with losses estimated in the $116–$130 million range.
The vulnerability stemmed from a March 2021 firmware build configuration (affecting versions roughly 4.0.1 through later releases) that caused seed generation to fall back on a weak software pseudo-random number generator instead of the device’s dedicated hardware entropy source. This reduced effective randomness from the intended 128 bits to as little as ~40 bits on older Mk2/Mk3 models and ~72 bits on later Mk4, Mk5, and Q models—making many seeds computationally feasible to brute-force without physical access to the devices.
Attack waves began around July 30, 2026. The largest early sweep moved roughly 1,082 BTC from more than 1,100 addresses in about 41 minutes. Subsequent waves expanded the damage. Independent on-chain analysis by firms including Galaxy Research and TRM Labs has tracked confirmed or high-confidence losses of approximately 1,596–1,816 BTC (roughly $100–$116 million at prevailing prices), with a suspected additional wave potentially pushing the total toward ~2,000–2,055 BTC, or around $130 million. Thousands of addresses across multiple waves were affected.
Coinkite issued emergency firmware patches and urgent migration guidance. Updating the firmware prevents new weak seeds from being generated but does not repair existing seeds created on vulnerable builds. Affected users must generate entirely new seeds on patched firmware (or using strong alternative entropy methods such as physical dice rolls) and migrate funds immediately. The company has emphasized that products outside the affected Coldcard seed-generation path, such as TAPSIGNER, OPENDIME, and SATSCARD, are not impacted by this specific flaw.
On-chain tracking has shown that the majority of stolen Bitcoin has so far remained largely unspent or only lightly consolidated at attacker-controlled addresses, with limited evidence of extensive mixing or rapid laundering in the initial days after the sweeps. Multiple distinct attacker footprints have been observed, with some reports citing more than a dozen separate operators exploiting the same vulnerability.
The incident ranks among the larger crypto security events of 2026 and has intensified scrutiny of hardware-wallet entropy sources, firmware auditing practices, open-source review processes, and broader assumptions around pure self-custody. Security researchers and industry voices have reiterated long-standing advice on layered defenses, including multi-signature setups, diversified custody approaches, and rigorous verification of seed generation methods.
Users who generated seeds on Coldcard devices during the vulnerable firmware window are strongly advised to treat the situation as urgent, verify their setup against Coinkite’s latest advisories, and move funds to securely generated new wallets if any risk exists. The event continues to be monitored by on-chain analytics firms and law-enforcement investigators.
The content on CoinReporter.io is for informational purposes only and is not financial or investment advice. Cryptocurrency investments are highly volatile and risky. Always conduct your own research and consult a qualified financial advisor before making any investment decisions. CoinReporter.io and its authors are not liable for any losses resulting from actions based on this website’s content.
DeFi
Chainlink Partners with Bottomline to Enable Cross-Chain Payments for 600+ Banks

Chainlink just plugged itself into a pipe most people have never heard of — and that pipe already moves more money than most blockchains will see in a decade.
On September 3 the oracle network said it had entered a strategic partnership with Bottomline, a top-three Swift service provider, to open cross-chain and cross-border payment rails for Bottomline’s 600-plus bank customers. Bottomline’s platforms handle more than $16 trillion in payments a year. The firm also counts about 1,200 financial institutions and 10,000 businesses. One compilation put daily traffic near 10 million payments and estimated that roughly 15% of international Swift cross-border traffic already touches Bottomline’s stack. The banks keep sending ISO 20022 messages. Chainlink sits underneath and talks to chains.
That is the whole pitch. Do not rip out Swift. Add a settlement option.
What actually gets built
Two Chainlink products do the work.
CCIP, the Cross-Chain Interoperability Protocol, moves messages and tokenized value across supported public and private networks. It has been live since July 2023 and now spans more than 60 chains. CRE, the Chainlink Runtime Environment, orchestrates the workflow from the bank’s existing instruction through on-chain settlement and back — compliance checks, routing, confirmations — so the core banking system does not have to learn a new chain every quarter. Access is supposed to be a single, network-agnostic connection rather than a custom integration per ledger.
In practice a treasury desk can keep typing the same Swift message it types today. If the receiving side, or the bank’s own policy, wants the value to land as a token on a permissioned chain or a public one, CCIP and CRE handle the hop. Correspondent accounts, weekend gaps, and T+2 FX still exist until someone actually settles on-chain. The partnership is the adapter, not a replacement for the correspondent system.
Neither firm disclosed how many of the 600 banks will turn the feature on first, what volumes will run, or when production traffic starts. Several reports framed the work as still at proof-of-concept. Treat “600 banks” as the addressable base, not a live user count.
Why Bottomline is the interesting logo
Swift itself connects more than 11,500 institutions. It does not settle. It messages. The bureaus that sit between those messages and bank back offices are where integration actually happens. Bottomline, owned by Thoma Bravo, is one of the three largest of those bureaus. Wiring Chainlink there is different from signing a memorandum with a single money-center bank. It is a distribution deal: one integration, hundreds of potential endpoints, without asking each bank to stand up its own oracle stack.
That is also why the $16 trillion figure is easy to misuse. It is Bottomline’s existing payments book, almost all of it still fiat rails. None of that volume automatically becomes CCIP volume. The option is what changed. Banks that already trust Bottomline for Swift connectivity now have a vendor-supported path to public and permissioned chains that does not require a second operations team.
Where this sits on Chainlink’s bank map
The Bottomline announcement is not Chainlink’s first institutional payment story. It is the widest distribution story.
Project Pangea already groups more than 50 banks in Europe and South Korea — including the Qivalis euro-stablecoin cohort and Korea’s UniKA alliance — targeting near-real-time, stablecoin-based FX settlement in a corridor of about $150 billion in trade, with banks still speaking Swift and ISO 20022. Chainlink has also put CCIP in front of names such as JPMorgan, ANZ, UBS Asset Management, and the Hong Kong Monetary Authority. Data products — including U.S. official economic releases delivered on-chain — and state-level stablecoin work sit on the same enterprise calendar. Swift’s own head of strategy, Jonathan Ehrenfeld Solé, is slated to speak on digital-asset adoption at Chainlink’s Link:NYC event on October 29. The bureau deal and the Swift conference circuit are the same campaign: meet the bank where the message already lives.
LINK traded up about 6–7% on the news, around the low $12 area in some prints. Token reaction is not implementation. Fees from a live payments workflow would be the fundamental. Those have not been published.
What still has to be true
Three gaps sit between a press release and a cheaper wire.
First, production. A path for 600 banks is not 600 banks sending value on CCIP. Watch for a named pilot, a corridor, and a first live settlement date. Second, compliance. Cross-chain does not erase sanctions screening, travel-rule data, or the fact that a public-chain hop is a different risk committee conversation from a private one. CRE can orchestrate that. Banks still have to approve it. Third, the Swift question. Swift is running its own digital-asset experiments. A top bureau plugging in Chainlink is complementary until it is competitive. How those two interoperability stories coexist will matter more than which logo won Thursday.
If the integration ships, the efficiency case is straightforward: fewer nostro balances, fewer cut-off times, programmable settlement next to the same ISO 20022 instruction the bank already files. That is the RWA-and-payments thesis in a sentence — tokenized value moving on the message the industry already standardized. ICE–tZERO, LSEG–Payward, and DTCC’s Stellar hook are the securities version of the same idea. Bottomline–Chainlink is the payments version.
Until a bank posts a hash next to a Swift MT or pacs.008, call it infrastructure optionality. For an oracle network that has spent years trying to become the default middleware between those two worlds, optionality at $16 trillion of existing flow is the point of the announcement. The next update that matters is not another logo. It is a volume number.
-
Crypto1 month agoBinance Executes Monthly LUNC Burn: 275.6 Million Tokens Permanently Removed
-
DeFi4 weeks agoUniswap Labs Launches Memecoin Launchpad on Robinhood Chain
-
Crypto3 weeks agoFidelity Moves to Add Staking and Quarterly Payouts to Ethereum ETF
-
DeFi2 weeks agoJapan Issues First New Crypto Exchange License in Four Years
-
Bitcoin4 weeks agoBitcoin Asia 2026 Confirms Star Speakers for Hong Kong Conference
-
Crypto2 weeks agoTrump Hosts Crypto Executives at White House, Pushes CLARITY Act and Signals Support
-
Bitcoin5 days agoBitcoin Delivers Strongest August Since 2017 as Rally Digests Macro Signals
-
Bitcoin3 weeks agoBitcoin Holds Near $63,500–$64,000 After In-Line U.S. CPI Print
-
DeFi3 weeks agoOndo Stocks Surpasses $1 Billion; Broader Tokenization and Institutional Momentum
-
Crypto3 weeks agoBinance Wallet Launches Stock Hub to Simplify Discovery of On-Chain Tokenized Stocks
-
Bitcoin3 weeks agoTOKEN2049 Singapore Positions Itself as the Year’s Largest Industry Gathering
-
Bitcoin2 weeks agoBitcoin Surges Past $75,000 in Asia Trading as U.S. Treasury Moves Fuel Rally
-
DeFi1 month agoARK Invest Continues Crypto Equity Rotation with Coinbase and Circle Purchases
-
Bitcoin3 days agoStrategy Ends 10-Week Pause, Buys 4,603 BTC for $369.7 Million
-
Crypto3 weeks agoSEC Cancels Planned Crypto-Rule Meeting and Delays Tokenization Exemption
-
Bitcoin3 days agoSpot Crypto ETFs Attract Over $2 Billion in Weekly Net Inflows
-
Bitcoin2 weeks agoBitcoin Surges Past $79,000, Extending Powerful Rally to Highest Levels Since May
-
Crypto1 month agoStrategy Continues Bitcoin Sales; SpaceX Reports Bitcoin-Related Loss in Earnings
-
DeFi2 weeks agoHSBC & Standard Chartered: First Tokenized Deposit Deal + Digital Notes Issuance
-
DeFi1 month agoColdcard Hardware Wallet Exploit Expands to ~$89 Million Across 4,585 Addresses
-
DeFi3 weeks agoHyperliquid Sees Record Open Interest Amid RWA Perps Surge, Even as Revenue Declines
-
Bitcoin3 weeks agoGoldman Sachs to Acquire NEOS Investments for Up to $2.25 Billion
-
Crypto1 month agoBitGo CEO Challenges Anthropic with 100 BTC (~$6.3 Million) Wallet
-
DeFi1 week agoCharles Schwab is expanding Schwab Crypto beyond Bitcoin and Ethereum.
-
DeFi3 days agoTokenized Stock Volume Jumps 415% in a Month as Holder Base Explodes
-
DeFi2 weeks agoCoinbase and Circle Expand USDC Revenue-Sharing Arrangement
-
Bitcoin4 weeks agoStrategy Sells 1,690 BTC to Fund Share Buybacks and Bolster Cash Reserves
-
Crypto1 month agoCircle Shares Slide After Morgan Stanley Downgrade
-
Bitcoin3 weeks agoSEC Schedules Open Meeting to Advance “Regulation Crypto”
-
DeFi3 weeks agoBitcoin Reclaims $64,000 as Market Posts Modest Gains Amid ETF Outflows, Liquidation Risks and Miner Selling
-
Crypto4 weeks agoU.S. Senate CLARITY Act Hits Standstill Ahead of August Recess
-
DeFi1 week agoSEC Sends Crypto Custody Overhaul to White House
-
DeFi1 week agoU.S. Spot Bitcoin ETFs Extend Multi-Day Inflow Streak; August Tops $3B
-
Bitcoin1 month agoStrategy Sells Another 1,638 BTC; Saylor Clarifies Personal Holdings Untouched
-
Bitcoin2 weeks agoSEC Proposes “Regulation Crypto Assets” Framework
-
Bitcoin3 weeks agoMoneyGram Expands Crypto-to-Cash Ramps to Solana