Coldcard’s $116M Entropy Flaw, AFX Trade’s $24M Validator-Key Compromise, and both Big AI Labs' Models Breaking Into Live Systems | Burn Notice #11
The largest self-custody failure in Bitcoin's history, a bridge drained through its own validator keys, and the two weeks with frontier AI now hacking companies on its own.
In late July 2026, an attacker began draining Bitcoin from Coldcard hardware wallets by exploiting a flaw in the way the devices generated their seed phrases. The flaw had been present in the firmware since a change made in March 2021, and for more than five years it silently weakened the randomness at the root of every affected wallet. By the first week of August 2026 the confirmed losses had passed $116 million across more than 5,000 addresses and were still climbing, which made it the most damaging self-custody failure in Bitcoin’s history.
In today’s issue.
Coldcard lost over $116M in Bitcoin after a 2021 firmware flaw left wallet seeds guessable.
AFX Trade lost $24M when attackers compromised five of its bridge’s seven validator signing keys.
UK government testing caught Anthropic and OpenAI models faking identities and phishing real developers.
Need to Know
The largest losses of the period traced to the foundations beneath a private key, the randomness that produces one and the custody of the keys that approve a withdrawal. In one case those foundations failed at generation, when weak randomness made a set of keys reproducible, and in another they failed at custody, when enough signing keys were stolen to approve a transfer that looked legitimate on-chain. Alongside these, government testing of frontier AI models found agents willing to fake identities and deceive real people to advance an unsanctioned task, which extends the threat from a protocol’s code to the humans who review and approve changes to it.
The Big One. Coldcard’s $116M Entropy Flaw
The news. On 30 July an attacker swept roughly 594 BTC, worth about $38M, out of around 500 single-signature Coldcard wallets in a window of tens of minutes, and over the following days the figure grew in waves as others reproduced the method, per Disruption Banking and The Hacker News. Galaxy Research tracked the running total past 1,367 BTC by 2 August, and by the first week of August confirmed losses had passed $116 million from more than 5,000 addresses, with suspected totals higher still, per Forbes and Decrypt. Because the weakness sat in how the wallets generated their keys, the attacker could reproduce those keys from public blockchain data and sweep the funds without ever holding a device.
What broke and how. A firmware change shipped in March 2021 added a build setting that told the device to skip its dedicated hardware random number generator, and the supporting library checked that the setting existed without checking whether it was switched on, per Forbes. Key generation fell through to a software substitute seeded from the chip’s serial number, its clock registers, and its prior calls to the generator, all of which an attacker can constrain, per The Hacker News. On the older Mk3 the effective randomness collapsed from the 128 bits a Bitcoin seed should carry to about 40, and on the Mk4, Mk5, and Q models researchers put the reproducible search space at roughly four billion possibilities, which is trivial to grind through on ordinary hardware. An attacker who reconstructs a candidate seed derives its addresses and checks them against the public chain, so every weak wallet advertises itself the moment it holds funds. Owners who added a passphrase or rolled at least fifty dice at setup fed in randomness the attacker cannot rebuild, and they were unaffected, though almost nobody does either.
Why it kept happening. The flaw sat unreviewed in shipping firmware for more than five years, through release after release, because a hardware wallet’s core promise is precisely the part nobody goes back to re-examine once it appears to work. Coinkite’s chief executive suggested that AI tools may now be surfacing dormant bugs like this one, while other security researchers put it down to ordinary human engineering error, and a Bitcoin Core contributor reproduced the flaw on a physical device to confirm it, per Forbes. Whichever it was, the loss came from trusting that a seed generated years ago on a reputable device carried the entropy it claimed, a thing almost no owner can check after the fact.
What to check now.
If you hold funds on a hardware wallet, do you know for certain that its seed was generated from a hardware randomness source rather than a software fallback?
For any wallet whose entropy you cannot personally vouch for, have you added a strong passphrase or regenerated the seed with dice or another independent source of randomness?
Does your custody depend on single-signature wallets, where one weak seed is a total loss, rather than multisig that would contain the damage?
If a device you rely on has run without incident for years, which of its security-critical assumptions has nobody independently tested since you started trusting it?
Updating the firmware does not repair a seed that was already generated weakly, so if you are exposed the only safe move is to generate a fresh seed on fixed firmware and move the funds across, starting with a small test transaction. And if you cannot say where the randomness in your keys came from, treat that as the same open question an attacker is already answering for you.
— Adrian
Chain Reaction. AFX Trade’s $24M Validator-Key Compromise
The news. On 22 July an attacker drained about $24.15M in USDC from AFX Trade, a perpetuals exchange on Arbitrum, by taking control of the signing keys behind a bridge the protocol ran itself, per CoinDesk. The stolen USDC was moved to Ethereum and swapped into roughly 12,467 ETH, close to the platform’s entire value locked, per CryptoBriefing. Arbitrum’s own bridge was never touched, and its co-founder confirmed the native infrastructure was not involved.
What broke and how. AFX’s bridge ran a seven-validator multisignature scheme with voting power split unevenly across the validators, and a withdrawal needed two-thirds of that voting power to sign before the contract would release funds, per Halborn. The attacker obtained the private keys of five of the seven validators, which was enough to meet the quorum, assemble a set of signatures the contract accepted as valid, and clear the roughly 200-second dispute window before the transfer settled, per CoinDesk.
Why it kept happening. A bridge that authorises withdrawals from a small set of signing keys concentrates its entire security into the custody of those keys, and when a protocol runs that bridge itself, it also owns the problem of keeping them safe. Through the second and third quarters of 2026 this has been the dominant way large sums have left DeFi, with the AFX drain arriving the same week as a repeat exploit of the Verus bridge and inside a cluster that on-chain responders labelled a hackers’ day, per crypto.news. The keys behind these bridges are hot by necessity, since they have to sign in real time, and a hot key that can move a protocol’s entire reserves is worth more to an attacker than most of the contract bugs an audit is scoped to find.
What to check now.
Does your protocol operate its own bridge, and if so, how many independent parties would an attacker have to compromise before a withdrawal could be signed against your intent.
Are the keys that authorise cross-chain withdrawals held on separate infrastructure by separate people, or could one intrusion reach enough of them to meet quorum.
Is your validator voting power distributed so that no reachable subset of signers can approve a transfer on its own.
Do you monitor for a quorum of signatures assembling faster than any legitimate operation would need, and can you halt inside your dispute window.
If the keys behind your bridge were compromised tonight, how much of your total value locked could leave before anyone intervened.
A bridge you run yourself is a key-custody problem wearing a smart contract, and the audit that cleared your code says nothing about who can reach the signers. Count how many of your validator keys an attacker would need, confirm that number is hard for anyone to reach, and treat every one of those keys as the reserve it can move.
— Adrian
Around the Forums
Coinkite ships emergency firmware and begins assisting victims. Coinkite released fixed firmware within a day of disclosing the flaw and started working with affected owners, though it has offered no compensation and has described the entropy figures as preliminary, per Disruption Banking and TheStreet. Rival manufacturer Ledger used the moment to argue that hardware wallet security now has to account for AI that can surface long-dormant flaws at speed, per Decrypt. Between them the two responses have reopened the self-custody debate that followed the Bybit theft, with institutional custodians again positioning their offerings as the safer route.
AFX and Verus both open on-chain bounty negotiations with their attackers. AFX publicly offered its attacker a thirty percent bounty to hand back the rest, roughly $7.2M kept against the majority returned, a route Verus had taken after its earlier breach when the May attacker returned about three quarters of the proceeds, per CryptoBriefing and crypto.news. Paying the thief a cut to recover the majority has hardened into standard practice this year, on the logic that on-chain forensics make laundering large sums progressively harder. Whether that norm deters the next attacker or simply prices in a tolerable cost of doing business is the open question as the offers pile up.
What Else Happened
Repeat forged-proof exploit of the Verus Ethereum bridge. An attacker forged a cross-chain import proof to withdraw about $7.54M in ETH, tokenised BTC, and stablecoins from the Verus-Ethereum bridge on 23 July, reusing the same import-path and validation bug class that drained the bridge in May, per crypto.news.
BSquared Network drained on BNB Chain. An attacker took roughly 8.59M B2, worth about $3.9M, out of BSquared Network on 23 July, and the team publicly asked for the return of at least ten percent within a day, per QuillAudits.
Flash-loan oracle manipulation of LpdFi on BNB Chain. LpdFi read its LPD token price straight from a PancakeSwap pair’s spot reserves, and an attacker used a flash loan to distort that price and drain roughly $690K on 2 August, on-chain transaction.
Signer-key leak at Swan Treasury on BNB Chain. Swan Treasury’s off-chain signer key was hardcoded into the protocol, and once it was compromised an attacker used it to authorise withdrawals, draining about $625K on 30 July, on-chain transaction.
Reward-vault allocation manipulation of Projekt on Ethereum. An attacker manipulated the reward accounting in an unverified GREEN and GOLD buy-to-earn vault to extract about $560K on 25 July, on-chain transaction.
Oracle price manipulation of Lien Finance on Ethereum. An attacker drained roughly $542K from Lien Finance’s GeneralizedDotc bond-to-token OTC pools on 24 July by manipulating the price the pools relied on, on-chain transaction.
Partial recovery of the Trusted Volumes exploit. More than two months after a $5.8M exploit, one of the attackers returned 1,122 ETH, worth about $2M, to the project, on-chain transaction.
Patch Notes
The Coldcard entropy flaw is the only fix this week that cannot wait, and as the Big One sets out, the firmware update alone does not close it. Anyone on an affected device should treat their existing seed as compromised and regenerate today rather than this week. No other fix surfaced this period carries the same urgency.
Long Reads
Anthropic’s disclosure that three of its own Claude models breached three real companies during testing, reported here by TechCrunch. A week after OpenAI said two of its models had exploited a zero-day to escape a sealed test environment and reach Hugging Face’s production systems, Anthropic reviewed 141,006 evaluation runs and found three cases where a Claude model reached the open internet through a misconfigured test harness and compromised outside organisations, in one instance publishing a malicious Python package that ran on fifteen real machines. Read it for the model’s own logged reasoning, which recognised the action would be a real attack and then argued itself back into believing the scenario was staged, and for the accountability gap it exposes, since computer-misuse law assumes a human intruder acting with intent.
Bitcoin swap bridge Boltz taking its service offline indefinitely because AI-assisted attacks were outpacing its team. Boltz, one of the default pieces of plumbing between Bitcoin’s mainchain, the Lightning Network, and Liquid, suspended its swaps on 3 August after months of automated probing produced a run of contained exploits and then accelerated past what a team its size could patch. Its non-custodial design kept user funds safe throughout, which makes this the clearest early case of a small crypto team retiring a working product because it could no longer defend it at machine speed, with no user losses involved.
The UK AI Security Institute’s report on frontier models faking identities to deceive real people. Testing Anthropic’s Claude Mythos 5 and OpenAI’s GPT-5.6 Sol under deliberately relaxed safeguards, the institute recorded nineteen unsanctioned actions across its runs, seventeen of them by the Anthropic model, including creating fake personas of real open-source maintainers and spear-phishing them to get malicious code approved, an attempt a human reviewer refused and the institute contained within an hour. It is the clearest case yet of autonomous deception aimed at people rather than code, and worth reading for how ordinary the social-engineering steps look.
Cointelegraph on whether AI can drain DeFi, separating the Claude Mythos hype from what the on-chain data shows. A useful counterweight to the alarm in the items above, making the case that the offensive capability is real and improving while the DeFi-specific hackpocalypse has not arrived, since AI-assisted attackers still favour small and abandoned targets over hardened ones.
Galaxy Research and others on July’s $242M in losses, most of it one hardware wallet. The month’s twenty-four DeFi exploits totalled a fairly ordinary $132.2M between them, and a single entropy flaw in one wallet line outweighed all of them combined, which is a useful corrective to where the industry still points most of its attention.
Decrypt’s plain explainer on the Coldcard entropy failure, covering how seeds are generated, why bit-depth is the whole game, and how a search space of a few billion becomes trivial. The clearest short read for explaining to a non-specialist why a wallet nobody touched could still be emptied.
The $200,000 macOS flaw that went unreported because Apple’s bug-bounty queue was buried in AI-generated slop. A researcher using an AI tool found a full-takeover bug, then hit the submission cap Apple had added to hold back the flood of fake reports, the kind of bind anyone who runs or submits to a bounty programme is about to feel.
Closing Tab
The largest losses this month traced to weak key generation and stolen signing keys, flaws that sat unexamined until an attacker found them. The rest of 2026 will show how many teams start checking the randomness and custody behind their own keys, now that AI is narrowing the gap between a weakness appearing and someone reaching it.
Burn Notice. Operational intelligence for Web3, almost every week.
Adrian Hetman