In the early hours of August 4, 2026, Beijing time, the “surface of the crypto world” suddenly rippled with an eerie disturbance.

A Bitcoin address that has been as dead as if nothing happened since 2013: 18TExP suddenly moved. 500 BTC (worth about $31.3 million) were transferred the moment the block was confirmed. This wallet had been asleep for a full 12 years and 8 months—older even than the birth of Ethereum.

While the public speculates whether this is Satoshi Nakamoto himself making a reappearance, another even more chilling backdrop has come to light: Coldcard—the “fortress” of Bitcoin hardware wallets—has just been exposed as having a fatal security vulnerability, and BTC worth over $100 million is being stolen.

The process of discovering this vulnerability made people see the power—and the threat—of AI even more. After the Coldcard team released a security bulletin in late July, someone gave the source code to an AI model called Claude Code for review. The result: AI pinpointed the exact line of code that caused the randomness to collapse in just 8 minutes.

The revival of the ancient giant whale and the fatal vulnerability in the Coldcard wallet collide—was this a coincidence of a “mass migration,” or a precise hunt targeting the ancient giant whale?

Today, we won’t talk about hype. In plain, everyday language, let’s break down the technical behind-the-scenes battle behind this “earthquake” in the crypto world.

Coldcard vulnerability: a fortress claimed to be “unbreakable”—why did it collapse?

In the eyes of crypto geeks, Coldcard has long been synonymous with “hardcore security.” Its biggest selling point is “fully offline generation of private keys.” In theory, as long as it isn’t connected to the internet, even gods can’t steal your coins.

But this time, hackers didn’t go steal your computer. They simply “guessed” your private key.

What is the essence of a private key? It’s an enormous string of randomness. Generating a private key is like shuffling a deck of cards— the more thoroughly you shuffle, the higher the randomness, and the harder it is for others to guess.

This time, Coldcard made one of the most classic beginner mistakes for programmers: insufficient PRNG entropy (“pseudo-random number generator” entropy is too low).

In a firmware update in March 2021, the Coldcard team introduced a bug. This caused that when generating private keys for certain models (such as Mk2 and Mk3), the randomness was reduced to only about 40 bits.

The numbers tell you how absurd this is: the security level of a Bitcoin private key is 128 bits. That means that if hackers were to brute-force it, they would need to try 2^128 times—more than the number of atoms in the universe.

But when the entropy value drops to 40 bits, the possible combinations instantly shrink to about 1 trillion (2^40).

Does a trillion sound big? For a typical computer, it’s indeed an astronomical number. But for hacker groups with powerful computing resources—or teams equipped with professional GPU clusters—brute-forcing these 1 trillion combinations could take only days or even hours!

It’s like changing your safe’s password from an “8-digit number” to a “4-digit number.” In front of professionals, that safe is effectively useless.

Is a cold wallet really safe? Crypto-asset security is entering a new phase

Over the past few years, against the backdrop of frequent exchange blowups, runaways, and withdrawal freezes, “don’t keep your coins on an exchange” has become a consensus in the crypto industry. More and more long-term Bitcoin holders are choosing: hardware wallets, cold wallets, and multi-signature wallets.

Because they’re considered the safest way to protect BTC. However, this security incident involving the Coldcard hardware wallet once again reminds the market: cold wallets are not absolutely safe. What truly protects assets is not the “device itself,” but a complete security system—from random generation, to private key management, to backup mechanisms.

What is the security logic of a hardware wallet? Take the Coldcard under Coinkite as an example. At its core, it’s an “offline private key generation and signing device.” Normal flow: the device generates randomness → generates 12/24 mnemonic words → the mnemonics generate the private key → the private key controls the BTC address → the user stores it offline.

In theory, brute-forcing is almost impossible. Even if the device is lost, as long as the mnemonic is secure, the assets remain safe—so many long-term Bitcoin holders choose hardware wallets.

This vulnerability was not caused by hackers breaking into Coldcard devices, or remotely controlling wallets, or by users leaking mnemonic phrases. Instead, in some versions, when Coldcard generated mnemonic phrases, it did not use a sufficiently strong source of randomness.

As mentioned above, throughout the entire process the attacker only needs to compute mnemonic phrases from a finite set of possibilities, generate private keys, identify the corresponding BTC addresses, and move the funds—without needing to touch the user’s device at all.

Based on currently public data: in the first wave of the attack, about 1,196 addresses were stolen from, totaling about 1,082 BTC. Losses expanded across multiple subsequent batches. According to tracking by organizations such as Galaxy Research, as of early August: the confirmed losses exceed 130 million USD, with more than 7,300 wallets affected. The hacking group has at least 15 independent hacker organizations using this vulnerability to “fish.”

The biggest significance of the Coldcard incident is not to prove, “Cold wallets are not safe.” It is to remind us that the security of crypto assets is moving from the era of “storing private keys” to the era of “managing risk.”

Why did the 500 BTC of 18TExP, which had been dormant for 12 years, draw attention?

Mainly because the timing was too coincidental: after the Coldcard vulnerability incident was exposed, a large number of users began checking the security of their cold wallets. Then came speculation: did this ancient BTC wallet migrate its assets early out of concern for security issues?

But currently, there’s no evidence that the two are related. The reason is simple: in 2013, Coldcard didn’t even exist, so this address could not have been generated by Coldcard in the first place.

A more reasonable explanation is that the giant whale took proactive defense measures in response to security concerns sparked by the Coldcard incident—changing wallets, upgrading security solutions, and replanning asset management. Of course, it’s also possible that long-term holders sold or did OTC trades. 500 BTC is not unusual for early miners and investors.

This isn’t an isolated case. Data shows that after the Coldcard vulnerability was exposed, the activity of the network’s “ancient coins” that had slept for 7–10 years surged. A silent “last stand” is unfolding behind the scenes.

A “life-saving” guide for all BTC holders

Coldcard vulnerability incident—tell us one very important thing: asset protection has no absolute security.

In the past, we only asked, “Put it on an exchange or a cold wallet?” Now we need to upgrade to, “How do we design a whole asset security system?” Because any link in the security chain—firmware, randomness generation, supply chain, backup habits, and usage environment—can fail.

For ordinary users, one hardware wallet might be enough, but large BTC should not rely on single-point security. The risk of a single-wallet setup is becoming increasingly high. A more mature approach is to implement layered defenses: first layer—a hardware wallet; second layer—independent backups; third layer—a multi-signature wallet; fourth layer—diversify assets.

For example, don’t do one wallet with 1,000 BTC and one mnemonic. Instead: 10 wallets with 1,000 BTC and 10 mnemonics.

For large-value assets, consider multi-signatures—such as a 2/3 multi-sig: three devices—one at home, one in a bank safe deposit box, and one with a trusted relative. Two signatures are required to transfer. Even if one device is leaked, the assets remain safe.

Finally, if you or a friend of yours is using Coldcard—or any hardware wallet—please remember: “migration” is more important than “upgrading.” Simply upgrading Coldcard’s firmware cannot fix old private keys that were already generated. You must immediately transfer your assets to a newly generated address, and that new address must be generated using the patched firmware version.

Check the model. The Coldcard models mainly affected are: Coldcard Mk2, Mk3, Mk4, and Q. If you’re using one of these and the creation time is between 2021 and 2023, it’s been exposed to risk by default.

If you have a wallet created around 2013–2016, even if it isn’t Coldcard, this “giant whale migration” incident is also a warning. Old address formats and generation algorithms are always “fat targets” in the eyes of hackers. Proactively migrating is taking responsibility for your wealth.

The Coldcard incident does not overturn the value of hardware wallets. On the contrary, it shows that: hardware wallets are still an important tool for protecting Bitcoin today, but no security tool is absolutely safe.

If you’re not sure whether the wallet or trading platform you’re using has risks, you can use a third-party compliance query platform like WikiBit to help you make a judgment. Of course, any third-party tool is only for reference. The final security line is always in your own private key management system.

Whether you use an exchange, a software wallet, or a hardware wallet, the first principle of crypto-asset security is: don’t put all your assets on a single platform, a single device, or a single-key-structure system. Distributing risk matters more than chasing a so-called “absolute security.”

Conclusion

The “waking up” of 18TExP might just be a routine operation by an ancient big player; the Coldcard vulnerability might just be a pit along the path of technical evolution.

But when these two things are combined, they reveal a cold reality: in the crypto world, security is a luxury. A hardware wallet isn’t the endpoint, and even the code is not absolutely secure. True security comes from respect for the underlying logic—and never letting vigilance lapse.

That wallet slept for 12 years—not because it was secure, but because it was never discovered. The moment it woke up, the crisis may have just begun.