The number keeps climbing and that's the part nobody's prepared for. What started as a $38M drain on July 30 has grown wave by wave 1,082 BTC (~$70.2M) taken across 1,196 addresses in just 41 minutes during the first major sweep and by August 2–3 the running total reportedly reached roughly 1,367 BTC, about $89 million, from 4,585 addresses.
The root cause isn't exotic. A 2021 firmware integration error routed seed generation through a deterministic software random-number generator instead of the device's dedicated hardware RNG, meaning attackers who could constrain a few device parameters could reconstruct seed phrases entirely offline no physical access needed.
That's the uncomfortable part for self custody advocates: the device never left anyone's hands, and funds still moved. A firmware patch exists, but it only protects wallets generated after the fix anyone whose seed was created on vulnerable firmware needs a fresh wallet, not just an update.
Worth watching whether this accelerates a shift toward regulated custody and ETFs over pure self custody, or just resets best practices around seed rotation.
$BTC #bitcoin #cryprto #CryptoNews