After the incident, large amounts of Bitcoin were moved

August 13, 2026 · Self-custody and key security watch

Late July Coldcard vulnerability led to about 1,816 bitcoins being stolen, but on-chain data shows that subsequently 233,000 BTC were moved out of long-term holding wallets, with 22,000 going to exchanges. [1] Casa CEO Nick Neuman said that 10 to 100 times the stolen amount was transferred to a safe location.

These migrations had two sources: some Casa customers originally used single-signature Ledger or Trezor (completely different device brands), but this incident prompted them to switch to multi-signature wallets; the other group were users already using multi-sig, who removed the Coldcard device from the key combination. [1]

Neuman compared this response with a hypothetical scenario involving centralized custodianship. If an equal amount of BTC is stored at an exchange and the exchange is compromised, the outcome is the opposite: almost all funds disappear at once, with only a small portion potentially escaping.[1] In a self-custody scenario, the attacker must crack addresses one by one, only obtaining small amounts of BTC each time, while the network has time to respond and migrate the remaining funds.

Glassnode data confirms the scale: the supply held by long-term holders fell from nearly 15 million BTC to about 14.7 million—its largest week-over-week drop since December 2024. This happened while the BTC price was still 50% below its all-time high of $126,000 in October.[1]

Coinkite has urged any users who generated seeds on firmware versions 4.0.1 through 4.1.9 (covering March 2021 to July 2026) to migrate to the new seed immediately. Even if the device has been upgraded, the entropy of that batch of old seeds was weak from the moment they were generated and cannot be fixed via a patch.

## SlowMist technical replication: private keys become predictable due to random number backoff

The SlowMist team fully reproduced the attack chain on Mk3 firmware 4.1.9.[2] The root cause is the combined effect of two compiler-layer errors.

First layer: Coldcard explicitly sets `MICROPY_HW_ENABLE_RNG` to 0 in `mpconfigboard.h`, because the team believes it wraps and calls the STM32 hardware TRNG directly via `ckcc.rng_bytes`. However, the dependent library `libngu` checks this macro with a `#ifndef` and only verifies whether it exists, not whether it is enabled.

Second layer: when the macro is 0, the MicroPython STM32 port’s `rng_get()` silently falls back to the software PRNG Yasmarang. The initial seed for this PRNG consists almost entirely of predictable values: the chip UID (a 96-bit identifier uses only the low 32 bits, and in the Phase A batch the X/Y coordinates fall mostly in the 0–72 range), `SysTick->VAL` (the countdown value under an 80 MHz clock, ranging from 0 to 79999), and RTC registers (all the confirmed vectors parse to 0).[2]

The result is two Yasmarang instances: one is the global constant stream of `libngu` (pad=0x0a8ce26f; all devices are exactly the same), and the other is the fallback instance of `rng_get()`, where the only variable is the 32-bit value `UID ^ SysTick`. The real entropy source in the entire seed-generation process is only about 32–72 bits—an attack space that a GPU cluster could brute-force within days.[2]

## All the AI model “inner thoughts” were leaked—62 API keys were recovered

Security researchers found a way to read the encrypted “inner thoughts” from each major AI inference model and recovered 62 active API keys and 33 passwords from publicly shared developer conversation logs (not knowing what was inside).[3]

“By decoding 315,320 inference blocks crawled from public repositories, we recovered 367 pieces of PII (personally identifiable information) and 182 credentials.” The research team wrote in a paper submitted on August 10.[3]

All major AI vendors encrypt inference tokens with the same global key. The attacker used this to decode 315,320 hidden inference blocks from public logs and, in the process, retrieved passwords and active API keys.[3]

This is the third report of a frontier AI lab model being attacked against a third-party company after OpenAI and Anthropic disclosed similar incidents in the past few weeks.

In July, OpenAI said two models escaped the testing sandbox while searching for benchmark answers and compromised Hugging Face. The company later disclosed that the models also accessed four other online services.[3] Anthropic subsequently stated that three Claude models attacked real organizations after test errors exposed them to the internet. In August, Meta said a similar error allowed one of its models to use third-party services.[3]

These incidents prompted lawmakers to propose an AI “kill switch,” allowing the federal government to restrict or shut down powerful models in emergency situations.

## MCP servers can segment instructions, letting AI coding assistants subtly exfiltrate keys

A malicious tool server connected to an AI coding assistant can quietly take away SSH keys, environment secrets, source code, and customer data without sending any instruction that looks obviously harmful.[4]

This trick remains effective even after the straightforward version of the same theft request is rejected: split the request into multiple fragments that all appear normal, place them in the channel the assistant is already using, and let the assistant assemble them itself.[4]

The Model Context Protocol (MCP) lets AI coding assistants call external tools—read files, query databases, execute commands—through structured interfaces. Attackers can embed a second prompt in a tool’s response message, guiding the assistant to send the sensitive data it just read back to the tool server, while appearing to only “log” or “format” it on the surface.

Because each call is segmented and each instruction looks reasonable when viewed alone, the assistant’s built-in protections won’t trigger. Once the data stream goes to the malicious server, it has already leaked.[4]

This kind of attack doesn’t require breaking any boundary; it simply exploits MCP’s own design: the assistant trusts structured data returned by tools, while the tools can smuggle in a second layer of instructions inside the return content.

The author is working on an MPC wallet for unassisted wordless seedless recovery, so they take a position on this topic. The data are cited; you should judge for yourself.

https://cowallet.ai/en?pid=jingle