News

369 Guard

Global security awareness — not only PulseChain.

Permalink for this incident. Same content as the News feed — use Share to post it.

All newsAbout

Cross-chain security awareness in plain English. Not an audit. Not financial advice. We never publish drain recipes or exploit steps. News items are research snapshots from public reporting — not always a full 369 deep-dive.

highBitcoincustodyUpdated

Coldcard seed advisory widened; ~594 BTC single-sig sweep still unproven link

30–31 Jul 2026: Coinkite warned that device-generated seeds on Coldcard Mk3 (firmware 4.0.1+) may put funds at risk. Updated advisory also flags seeds generated on Mk4 / Mk5 before 5.6.0 and Q before 1.5.0Q (~72 bits entropy vs expected 128); TAPSIGNER / OPENDIME / SATSCARD not in scope. Around the same window, ~594.48 BTC (~$38M) from ~500 single-sig wallets consolidated (Lookonchain cites bc1qnk4zh…). Causal link “sweep = this RNG bug” is not proven by Coinkite — treat viral “stolen due to Coldcard” lines as Real-overstated. Dice rolls (≥50 fair) and strong BIP-39 passphrases change exposure; migrate calmly per vendor guidance.

Update (2026-08-02) — Second sweep wave — Galaxy tracking ~1,158 BTC: 1–2 Aug 2026: Galaxy Research mapped a second wave attributed to the same operator class. Combined tracking ~1,158 BTC (~$70–75M class) from ~2,673 addresses across multiple attacker wallets (CoinDesk earlier expansion ~1,083 BTC / 1,196 wallets; some desks still climbing toward ~1,367 BTC). Firmware patch does not fix an already-weak seed — new seed + migrate. Causal “every sat = this RNG bug” remains research-attribution (Block/Galaxy), not a Coinkite courtroom proof — treat viral max $ as Real-overstated until settled. Enumeration is still running; don’t wait for a “final” loss total to migrate calmly.

Update (2026-08-02) — Third wave — +~208 BTC; Galaxy total ~1,367 BTC / 4,585 addresses: 1 Aug 2026 (Bitcoin Magazine pickup of Galaxy Research): a third sweep wave reported with another ~207.73 BTC moved. Combined tracking now ~1,367.05 BTC from ~4,585 addresses. Still the same enumeration campaign class — figures keep climbing as more bags are found. Review Coinkite’s official seed guidance; firmware alone does not repair an already-weak seed. Treat press “hack” shorthand and max-$ headlines with a Verify bar until causation vs total is settled.

Update (2026-08-03) — Fourth wave — ~449 BTC class; cumulative still climbing: 3 Aug 2026: Galaxy’s Alex Thorn flagged a likely fourth organized sweep while some spends were still in the mempool (~388–449 BTC range; later tally ~448.7 BTC from ~709 suspected addresses). RBF tip for unconfirmed spends only — once confirmed, migrate. Arithmetic add-on to prior three-wave ~1,367 BTC pushes observed totals toward ~1.8k BTC class — that sum is research tracking, not a Coinkite-confirmed final. Firmware update still does not fix an already-weak seed; generate new seed on fixed firmware and move calmly.

369 take: Seed quality and single-sig habits matter as much as smart-contract risk. Check device and firmware provenance, prefer strong passphrases or modern custody practices, and verify vendor advisories before you move size. Don’t treat on-chain aggregators as proof of root cause. Pulse lesson: long-dormant single-sig bags are a soft target when generation entropy was weak.