PREMIUM NEWSLETTER FOR PAYING SUBSCRIBERS .

They did everything right. Their Bitcoin vanished anyway.

Here's what really happened, and what it changes.

Hey all,

I want to talk about the most unsettling thing I've seen in this space since Celsius, BlockFi and FTX. Not because of the dollar figure — we've seen bigger. Because of who got hit, and how.

Over the past week, an attacker drained more than $130 million in Bitcoin from thousands of wallets — and it's still climbing. These weren't exchange accounts. They weren't hot wallets. They weren't people who clicked a dodgy link or typed their seed into a fake website.

They were self-custody purists. People holding on a Coldcard — an offline, Bitcoin-only hardware wallet marketed to exactly the kind of person who takes this seriously. 

Keys that never touched the internet. Addresses verified on the device screen. Every box ticked.

And the coins are gone anyway.

Sit with how brutal that is for a second. Some of these were long-term holders who white-knuckled the entire bear market from the $125k top — or have been saving bitcoin since below $3k. They did the hard part, held through the pain, right up to near what may well be the bottom — only to be wiped out not by the market, but by a single line of code written in 2021.

Here's what actually happened — in plain English. 

A hardware wallet's one job is to generate your secret key using true randomness, so no one on earth can guess it. A firmware update Coldcard shipped back in March 2021 quietly broke that. Instead of using the device's proper hardware randomness, a bug routed key generation through a software shortcut — making the "random" keys far more predictable than anyone knew. For years, nothing happened. Then someone (likely using AI) realised they could reconstruct those keys without ever touching the physical device. No theft. No hacking of your computer. Just math, done from anywhere.

The device that was supposed to be the one place a hacker couldn't reach became the front door.

Now — before anyone panics — this is narrower than the headlines suggest.

This is specific to Coldcard, not Ledger or Trezor, or any others. It only affects a specific firmware on Coldcard but it appears to be a critical error that will be near impossible to come back from. I would highly recommend, even if you own a Coldcard model or version that is not affected, out of an abundance of caution move your Bitcoin off the device.

The overwhelming majority of self-custodied Bitcoin holders were never exposed at all, but we should discuss the implications for everyone not on Coldcard and the future of self-custody in general.

Every serious investor has to answer: if the most secure setup in crypto can fail like this, where is your Bitcoin actually safest?

That's what we're getting into with my suggestions to make your set-up near bulletproof. 

Let's get past the shock and into the lessons — because there are four, and they're the kind that change how sophisticated investors operate. If you’re one of those - pay attention.