SESHIRO

OVERVIEW
For years Coldcard was the hardware wallet that serious Bitcoin holders pointed to when asked where large amounts should go. Made by Canadian company Coinkite since 2017, it built a reputation as the paranoid Bitcoiner's cold storage of choice. Air gapped. Bitcoin only. Open source firmware. Dual secure elements. The kind of wallet that made people feel genuinely safe.
Then on July 30 2026 everything changed.
On the morning of July 30 2026 a single attacker emptied 1,196 Bitcoin addresses in about 41 minutes. Roughly 1,082 BTC worth around $70 million at the time moved out of wallets that had never once touched the internet.
By the time the dust settled the confirmed take had passed $130 million across more than 5,200 addresses and it was still climbing. It is the largest hardware wallet exploit in crypto history and the third largest crypto hack of 2026.
WHAT IS COLDCARD
Coldcard is made by Canadian company Coinkite since 2017. It built a reputation on Bitcoin only design, dual secure elements, open source firmware and layered physical security features that most competitors did not offer.
It was not a wallet for beginners. It was the wallet serious self custody advocates recommended for people storing significant amounts of Bitcoin. The kind of device that made users feel like they had done everything right.
As one victim put it after losing $1.6 million: "Perhaps the hardest part about this is that I did everything right. I never shared my seed phrase with anybody. My devices never touched the internet. Everything was kept in multiple safes and safety deposit boxes. None of it mattered. All because the hardware that created the seed phrase originally had one line in their code from 2021 that had a vulnerability."
That single line of code from 2021 is where the story really begins.
THE BUG THAT WAS HIDING SINCE 2021
A build configuration error in Coldcard firmware version 4.0.1 shipped in March 2021 routed seed generation to a deterministic software pseudorandom number generator instead of the device's STM32 hardware random number generator, reducing effective entropy from 128 bits to approximately 40 bits on Mk3 devices and 72 bits on Mk4, Mk5 and Q models.
Let us unpack that in plain language.
When you set up a hardware wallet for the first time it generates a seed phrase. That seed phrase is derived from a random number. The randomness of that number is everything. The more random it is the harder it is for anyone to guess or recreate your private key.
Coldcard's firmware was supposed to use its hardware random number generator to create that randomness. Instead a code error sent it to a software generator that was far less random and used predictable constants. The result was seed phrases that looked normal but were mathematically much weaker than they should have been.
The secure elements were never breached. The seeds they protected had been weak from the moment of creation.
Nobody knew. The wallets looked fine. The seed phrases looked fine. The security looked fine. But underneath every wallet generated on affected firmware between March 2021 and the patch release in July 2026 was a private key that could theoretically be brute forced by anyone with enough computing power and knowledge of the flaw.
HOW THE ATTACK UNFOLDED
An attacker began sweeping wallets on July 30 2026 draining 1,082 BTC from 1,196 addresses in 41 minutes during the first wave.
Twenty five minutes into that first wave hundreds of Bitcoin holders had already lost everything in their cold storage wallets. The speed was possible because the attacker did not need physical access to any device. They simply used the knowledge of the firmware flaw to computationally recreate the weakened private keys and drain the wallets remotely.
What started as what appeared to be a single coordinated attack quickly became something else entirely. The Coldcard exploit fragmented from a handful of coordinated waves into an open free for all with Galaxy Research estimating that at least 15 separate attackers are draining vulnerable wallets.
Blockchain analytics firm TRM Labs traced the activity to at least 15 distinct threat actors, some likely opportunistic copycats. Stolen funds have been routed through privacy tools including Wasabi and Tornado Cash according to CertiK.
Once the vulnerability became known it was not just the original attacker exploiting it. Others who understood the flaw piled in looking for vulnerable wallets that had not yet been drained.
THE VICTIMS DID NOTHING WRONG
This is the part of the story that makes it particularly difficult to process.
The uncomfortable part is that none of the victims did anything wrong. They did not click a phishing link, paste a seed phrase into a fake website or sign a malicious transaction.
Every piece of standard self custody advice had been followed. Keep your seed phrase offline. Never share it with anyone. Use a hardware wallet. Store it in multiple secure locations.
All of it was irrelevant because the problem was not with how users handled their wallets. The problem was baked into the device itself at the moment the wallet was first set up. A vulnerability introduced by a single line of code five years before the attacks began.
That reality has shaken the self custody community deeply. The promise of hardware wallets is that if you do everything right your funds are safe. The Coldcard exploit proved that doing everything right is not always enough if the hardware itself has a flaw you cannot see.
WHICH DEVICES WERE AFFECTED
Attackers exploited firmware versions 4.0.1 through 4.1.9 spanning from March 2021 to the patch release in July 2026.
This means any Coldcard user who generated their seed phrase on firmware within that range is potentially vulnerable. The flaw affected Mk3, Mk4, Mk5 and Q models to varying degrees with Mk3 devices having the weakest key strength at approximately 40 bits.
Updating firmware does not fix existing wallets. Anyone who generated a seed on a Coldcard between March 2021 and the patch should treat it as compromised and migrate to a new seed.
This is critical. Installing the latest firmware does not undo the damage. If your wallet was set up during the affected period the seed phrase it generated is still weak regardless of what version of firmware you are running now. The only safe action is to generate a completely new seed on a patched device and transfer funds to the new wallet.
THE BROADER QUESTIONS THIS RAISES
The incident is the largest hardware wallet exploit in crypto history and it is forcing the entire Bitcoin self custody model to answer a question it has avoided since inception: who audits the code that generates your keys?
Hardware wallets are trusted because they are supposed to be more secure than software wallets or exchange accounts. Users buy them specifically because they want to remove their funds from any online attack surface. The Coldcard exploit shows that the security of a hardware wallet depends entirely on the integrity of its firmware and the quality of its code at every step of development.
Coinkite's firmware is open source which is generally considered a security advantage because anyone can review the code. But open source does not mean every line of code gets reviewed thoroughly by independent experts. The flaw introduced in March 2021 sat undiscovered for over five years.
Onramp CEO Michael Tanguma noted that self custody and ETFs share the same flaw: a single point of failure. With an ETF that single point is the custodian. With self custody that single point is the device and the code running on it.
Neither is perfectly safe. They just have different failure modes.
WHAT AFFECTED USERS SHOULD DO RIGHT NOW
If you have a Coldcard that was set up between March 2021 and July 2026 here is what the security community is recommending:
Assume your current seed is compromised regardless of whether your funds have moved
Set up a brand new Coldcard on the latest patched firmware and generate a completely new seed
Transfer all funds from your old wallet addresses to new addresses generated on the new seed
Do this urgently because vulnerable wallets that have not yet been drained may still be targeted
Do not simply update the firmware on your existing device and consider yourself safe. The seed that was generated under the vulnerable firmware is still weak. You need a new seed generated under clean conditions.
CONCLUSION
The over $116 million in losses came not from a broken secure element but from weak seed generation, showing that hardware wallet security is not simply about the device's architecture. It is about the full stack: seed generation quality, firmware update hygiene and the user's ability to verify and respond to security advisories.
The Coldcard exploit does not mean hardware wallets are not worth using. It means the assumption that any device is completely infallible needs to be retired permanently.
Self custody is still one of the most powerful tools available to crypto users. But it comes with responsibility that goes beyond just buying the right device. It requires staying informed about security advisories, understanding what firmware your device is running and being willing to migrate funds when a vulnerability is discovered even years after your wallet was first set up.
The hardest lesson of the Coldcard exploit is that doing everything right today is not a guarantee of safety if something went wrong at the moment your wallet was first created.
In crypto that kind of hidden risk is real and it always has been.
IF YOU WANT MORE OF THESE INFORMATION, THERE'S WAY MORE COMING RELATED TO THE CRYPTO SPACE.
FOR NOW, FOLLOW US ON TWITTER: SMCRESEARCHERS
#BNB_Market_Update $BNB

Bitcoin stieg heute Morgen um bis zu 5,40% und durchbrach dabei wichtige Widerstandsniveaus, während institutionelle Zuflüsse einströmten. Die Trump-Regierung dämpfte die Lage im Iran und die Wiedereröffnung der Straße von Hormus kühlte Inflationsängste im Zusammenhang mit Öl ab — das löste risikofreudige Stimmung an den globalen Märkten aus. Spot-Bitcoin-ETFs verzeichneten in vier aufeinanderfolgenden Tagen kumulierte Nettozuflüsse von 664 Millionen. Der S&P 500 erreichte Allzeithochs und kletterte um 4,5% pro Woche — die dritte Woche in Folge mit +3%-Gewinnen, ein Muster, das seit 1950 nur zweimal zu sehen war.

Newton Protocol (NEWT) handelte im 6-Stunden-Fenster zwischen 0,0389 und 0,0406 und war in einen brutalen Range-Krieg eingepinnt. Der Kurs eröffnete um 4:17 Uhr bei 0,0406, fiel bis 6:43 Uhr auf 0,0389, erholte sich um 9:15 Uhr auf 0,0402 – Scalper bluteten auf beiden Seiten.
Börsen-Rangliste
Binance Futures dominiert mit 697K Nominal, der Spot folgt mit 156K. HTX führt unerwartet das Spot-Volumen mit 905K an. Bybit-Perpetuals liegen bei 2,26M mit Kursstellung bei 0,0397. Gate.io hält **0,0398 .** Die grenzübergreifende Gleichförmigkeit deutet auf dünne Liquidität hin, nicht auf Konsens.

Die Mitternachtswache
Das Newton-Protocol (NEWT) handelte zwischen 0,0386 und 0,0406 im Zeitfenster 00:00–06:00 UTC. Es war in eine enge Spanne gepinnt, die Momentum-Trader über Nacht gefangen hielt. Derzeit liegt der Kurs bei 0,0397 auf Binance Spot, 0,0397 auf Binance Futures und bei 0,0397 auf Bybit Futures – nahezu einheitliche Preisbildung deutet auf geringe Liquidität hin, nicht auf Konsens.
Angst dominiert
Der Fear-&-Greed-Index liegt bei 27,15, tief im Fear-Bereich. Marktrang: 1211 bei CoinGecko, 1232 bei Bybit. Umlaufmenge: 220 Mio. NEWT (22 % von 1 Mrd. max.). Haltedauer: 25 Tage spekulativ, nicht festgelegt.

NEWT wird heute Morgen um 0.03952** auf MEXC gehandelt, **1.27%** niedriger in 24 Stunden und **9.84%** wöchentlich [^34^]. Das Volumen liegt bei einem dünnen **53.64K — keine echte institutionelle Hysterie. Auf Platz #871 nach Marktkapitalisierung bei 9.54M $ — Micro-Cap-Gebiet mit Macro-Cap-Ambitionen. #Newt
Die Kraken-Bombe (27. Juli 2026)💣💣
Magic Labs — NEYTs Erfinder — verkaufte sein integriertes Wallet-Geschäft an die Muttergesellschaft von KrakeN, Payward, und benannte sich in Newton Labs um [^0^]. Sechzig Millionen Wallets wechselten den Besitzer. Das Team konzentriert sich nun ausschließlich auf die Protokollentwicklung. Bullische Konzentration oder Umsatzverstümmelung? Beide Interpretationen kursieren.

#Newt Der Newton-Protocol (NEWT) wird aktuell für 0,040 $ gehandelt – ein erstaunlicher Rückgang von 95 % gegenüber dem Allzeithoch. Für viele liest sich das wie eine Verwüstung. Für diejenigen, die die Infrastruktur beobachten, liest es sich wie eine Akkumulationsphase.
Der Unlock-Druck🔓🔑
Monatliche Token-Freigaben von 17,37 Millionen NEWT laufen bis Dezember 2026 weiter und erzeugen anhaltenden Verkaufsdruck. Bisher sind nur 21,5 % der gesamten Versorgung in den Umlauf gelangt. Die restlichen 78,5 % bleiben in Vesting-Plänen gesperrt, die bis 2029 reichen. Dieser Mechanismus beunruhigt Inhaber kurzfristiger Haltedauer. Außerdem bedeutet das: Der aktuelle Float ist künstlich knapp – jeder Nachfrage-Schub trifft auf ein dünnes Angebot.

Was ist das Newt Protocol?
Newt Protocol ist nicht nur ein weiteres DeFi-Projekt. Es ist eine Liquiditätsinfrastruktur der nächsten Generation, die das Fragmentierungsproblem lösen soll, das Web3-Märkte heute plagt. Stell es dir vor wie eine unsichtbare Autobahn, die isolierte Blockchain-Ökonomien verbindet – damit Assets, Daten und Wert nahtlos fließen können, ohne die Engpässe, die ältere Protokolle lahmlegen.
Im Kern nutzt Newt eine neuartige adaptive Bonding-Curve-Mechanik kombiniert mit atomarem Cross-Chain-Settlement. Übersetzung? Schnellere Trades. Geringerer Slippage. Echte Interoperabilität – nicht die falsche Art von Brücken, bei denen Versprechen und Hacking ausgenutzt werden.

ÜBERBLICK
ANSEM (The Black Bull) ist eine communitygetriebene Memecoin, die auf der Solana-Blockchain aufgebaut ist. Das Projekt wurde als Tribut an Ansem (Zion Thomas) ins Leben gerufen – einen der bekanntesten Trader und Influencer im Solana-Ökosystem. Seine Markt-Einblicke und die frühe Unterstützung für mehrere erfolgreiche Solana-Projekte haben ihm eine große Fangemeinde eingebracht.
Im Gegensatz zu traditionellen, auf Nutzen ausgerichteten Projekten schöpft $ANSEM seinen Wert in erster Linie aus der Beteiligung der Community und dem Einfluss der Marke Ansem im Krypto-Ökosystem. Obwohl der Token ursprünglich nicht von Ansem selbst erstellt wurde, hat er das Projekt später aufgegriffen und sich aktiv an seinem Wachstum beteiligt – durch Community-Engagement, Promotion und Initiativen, die sich auf Holder konzentrieren.

Das Problem, über das niemand spricht
Jeder KI-Agent verspricht, für dich zu handeln, auszugeben und auszuführen. Keiner kann beweisen, dass er es nicht stiehlt. Newton Protocol (NEWT) löst das mit kryptografischer Autorisierung — programmierbare, überprüfbare und widerrufbare Berechtigungen für finanzielle Abläufe, die von Maschinen gesteuert werden.
Was es tatsächlich aufbaut: Von TEE verifizierte Ausführungsumgebungen. Systeme für Zero-Knowledge-Beweise. Sitzungskeys mit Ablauf. zkPermissions mit granularen Einschränkungen. Ein Multichain-Keystore-Rollup, das Ethereum, Solana und Cosmos verbindet. Ein Operator-Netzwerk mit dezentralen Validator-Nodes. Ein Marktplatz, auf dem KI-Entwickler bewährte Strategien monetarisieren und Trader mit geprüfter Zuversicht bereitstellen.