$70M in Bitcoin Gone in 41 Minutes

On July 30, an attacker swept 1,082.65 BTC from 1,196 separate addresses in 41 minutes. At the time, that was worth approximately $70.2 million. According to The Hacker News, Galaxy Research traced the sweep to a firmware flaw in Coldcard — a Bitcoin-only hardware wallet made by Canadian firm Coinkite.

The root cause goes back to March 2021. A firmware integration error meant that when a Coldcard device generated a new wallet seed (the master key that controls all your funds), it used a weak software PRNG (pseudorandom number generator — software that mimics randomness) instead of the dedicated hardware chip designed to produce genuinely unpredictable numbers. The difference matters enormously: the software fallback was seeded from predictable values like the chip's unique ID and internal timer registers, collecting no additional randomness after startup.

Think of it like a combination lock that promises 1,000,000 possible combinations, but only ever generates one of about a thousand. An attacker who knows how the lock was made can try every realistic option without ever touching your device.

Crucially, exposure depends on which firmware was running when you first created your seed — not what you have installed today. Emergency firmware patches were released on July 31, but patching alone does not fix a seed that was already generated under the flawed version.

If you own a Coldcard, check your model and firmware history immediately. If your seed was created on an affected version, generate a new seed on the patched firmware and move your coins to the new wallet. Do not restore the old seed anywhere — the weakness travels with it.

Security researcher Elad Meged, a founding engineer at Novee Security, ran a controlled test against three vendors' own code repositories — using those vendors' default configurations. The attack chain was straightforward: a malicious pull request (a proposed code change) arrived with a seemingly routine bug report attached. An automated AI agent read the report, extracted shell commands from it, got them approved through the normal workflow, and posted the output back to the thread. The companies' own AI tooling did the work.

This is a prompt injection attack (manipulating an AI by hiding instructions inside content it reads) executed against a live development pipeline — not a lab simulation. According to Help Net Security, the test exposed how AI coding agents running with full user permissions can be weaponised through content they process before any human reviews it.

If your team uses AI-assisted code review tools, confirm that automated agents cannot execute commands without explicit human approval at each step.

CVE ID not confirmed in source — check the original advisory before acting.

What Coldcard is: Coldcard is a Bitcoin-only hardware wallet — a physical device that stores your private keys offline, made by Canadian company Coinkite.

What the flaw is: A 2021 firmware integration error caused wallet seed generation to use a weak software PRNG instead of the device's dedicated hardware RNG (random number generator). The software fallback produced seeds with far less entropy (unpredictability) than a secure wallet requires — roughly 40 bits on the Mk3, versus the 128 bits a standard 12-word seed should provide.

Who is at risk: Anyone whose seed was generated on an affected firmware version. Coinkite's advisory lists Mk3 versions 4.0.1 through 4.1.9 as vulnerable; Block's independent research also places Mk2 and Mk3 versions from 4.0.0 onward on the vulnerable path. Mk4 and Mk5 devices running firmware before 5.6.0, Q devices before 1.5.0Q, and Edge builds before 6.6.0X (Mk4/Mk5) or 6.6.0QX (Q) are also affected. The version running today is irrelevant — what matters is the version running when the seed was first created.

Recommended actions:

1. Install the emergency firmware released July 31 for your model.
2. If your seed was generated on an affected version, generate a brand-new seed on patched firmware and transfer all funds to the new wallet immediately.
3. Do not restore your old seed to any device or wallet — the weakness is in the seed itself, not the device.

A live AMOS (Atomic macOS) stealer campaign is targeting Mac users through fake "macOS toolkit" websites. The trick is simple: a site presents copy-paste instructions that look like a legitimate software setup step. You open Terminal (Mac's command-line tool), paste the text, and unknowingly install a credential-stealing app that harvests passwords, browser data, and cryptocurrency wallet files.

According to SANS ISC, the malware phones home to a remote server and begins collecting data immediately.

The fix is equally simple: never paste anything into Terminal from a website unless you have read it character by character and understand what it does. Legitimate software installers do not require this. If a site tells you to open Terminal and paste something, close the tab.

If you have already done this, change your passwords and check your accounts for unusual activity today.

No major compliance updates today.

The Balance Theory fundraise reported by Security Week is a private investment story, not a regulatory or policy development.