She wore Bitcoin on the Miss Universe stage. Now

(Alejandra Guajardo) is our new BitCorner guest. How does a beauty queen end up in Bitcoin? Subscribe so you don't miss it.

6.4 million bitcoin have exposed public keys, a new Quantum Alliance says (30.2% of supply).

No quantum computer can use that today. Google's new Willow result cut errors 40x, but only 8 in 100 attempts worked.

Freeze old coins, or let owners move them? 👇

BitCorner is more than a Bitcoin podcast 🇸🇻

5 seasons. 100+ episodes. Straight out of El Salvador, in English & Spanish.

Money. AI. Nostr. Austrian economics. Freedom. With Bitcoin always at the core.

Now everything lives in one place 👇

SEASON FINALE ALERT! 🔴 Working in Bitcoin is the dream for a lot of Bitcoiners. But how do you actually get in?

Thunder, Head of Talent (

) in the Bitcoin industry, first heard about Bitcoin from a university professor around 2009–2010. Today she hires for Bitcoin companies and sees hundreds of applications. She explains what recruiters really look for, why waiting a year for the "perfect" Bitcoin role can cost you, why Bitcoin startups have no time to hold your hand, and how Nostr, LinkedIn, AI-written CVs and privacy change the hiring game.

A sealed hardware wallet. A hidden implant under the screen. $86M+ drained.

The Ledger / CryptoBilis story in 75 seconds, and the 3 rules that protect your self-custody.

Would your device still pass the genuine check?

Bitcoin touched ~$80,300 on Thursday. This morning it's back near $82,500.

~$1B in leveraged positions got liquidated across crypto in the swing, ether hit far harder than bitcoin (per @CoinDesk).

If you held spot and did nothing, you barely felt it. Leverage paid the bill.

🚨Batman, Superman, Harry Potter and Game of Thrones just got a new owner.

Skydance closed its $110B Warner Bros deal on Oct 6. Now it trades as $SKYD: −2.7% day one, −8% day two, and a Fitch downgrade.

Centralized capital → centralized culture 👇 Full episode:

#Skydance #WarnerBros #Hollywood #CNN #Stockmarket

Want a spot in jail? Try to counterfeit money.

@1basemoney: one entity in every country holds the monopoly on money. It doesn't have to be the Fed. 👇

🎧 tinyurl.com/yck8u6sa New episode Tue 13 Oct, then every Tuesday · 16:00 CET Support: Jade code BITCORNERPODCAST

Coffee shops in BCN are super cozy.

You don't buy your coffee with money. You buy it with debt.

on why your credit card isn't even part of the money supply 👇

🎧 tinyurl.com/yck8u6sa

New episode Tue 13 Oct, then every Tuesday · 16:00 CET Support: Jade code BITCORNERPODCAST

BitCorner moves to Tuesdays.

From next week, a new episode every Tuesday at 16:00 CET · 10 AM ET. First up: E113 on Oct 13.

Until then, the one everyone is sharing: why Bitcoin is still under 5% of the world's base money.

🎧 Catch up before Tuesday: Spotify tinyurl.com/bdcsyy4u · Apple tinyurl.com/cj5wkhxv · Fountain tinyurl.com/yck8u6sa · YouTube youtube.com/@bitcornerpodc…

Bitcoin dropped about $2,000 in 20 minutes overnight, from ~$85.5K to a low near $83.6K.

Roughly $400M in leveraged longs were liquidated in under an hour (per @KobeissiLetter).

Leverage got flushed. If you hold spot in your own wallet, nothing happened to your keys.

This week Paramount + Warner Bros become one company 🎬

Fewer studios, fewer buyers.

"$50 million. No creative control. No equity. No residuals. And we won't tell you how your movie did."

Zack Mahoney on the streaming deal 👇

🎧 Parts 1+2: tinyurl.com/yck8u6sa

Strive bought 2,000 BTC last week and now holds 29,462. About 61.5% of the money came from selling preferred shares, a fixed-dividend Wall Street product.

Companies now fund Bitcoin with bonds and preferreds.

Would you buy a Bitcoin-backed preferred, or just the coin? 👇

Bitcoin Core 32.0 is due Oct 10. If you run a node, a 3-step checklist before you upgrade:

1. Back up your wallet
2. Download only from bitcoincore.org
3. Verify the signatures and SHA256 hash

No consensus changes, so there's no rush. Your node, your pace. 🔐

What is Bitcoin actually competing with?

Not stocks. Base money: cash + bank reserves. ~$26.2T.

explains 👇

🎧 tinyurl.com/yck8u6sa New episode Tue 13 Oct, then every Tuesday · 16:00 CET

Tuesday, Paramount closes its ~$110B takeover of Warner Bros 🎬

Netflix lost the bidding war. 12 states sued. The fix: a promise of 30 films a year.

Zack Mahoney (IndeeHub) told us the real story: consolidation 👇

🎧 Netflix vs Hollywood, Parts 1+2: tinyurl.com/yck8u6sa

Mt. Gox has 26 days left ⏳

Collapsed in 2014, 850,000 BTC gone. Arkham still sees 34,000 BTC ($2.9B). Deadline: Oct 31.

Will the last coins move before Halloween? 👇

🎧 tinyurl.com/yck8u6sa New episode Tue 13 Oct · 16:00 CET · 10 AM ET Jade code BITCORNERPODCAST

Gas wells with no pipeline. Methane from cow manure. A small hydro plant.

Bob Burnett (

) of Barefoot Mining explains how Bitcoin miners turn energy nobody else can use into something useful, and burn methane cleaner instead of letting it leak into the air.

This week South Africa's Eskom proposed selling its surplus solar power to Bitcoin miners. Miners as the buyer of wasted energy is already a real business.

Full episode, link in bio.

🎙️ New BitCorner episode Tuesday 13 Oct, then every Tuesday · 16:00 CET · 10 AM ET · 7 AM PT 🇸🇻 Support the show: Blockstream Jade code BITCORNERPODCAST (10% off) · Bitcoin Amsterdam tickets code BITCORNER. Links in bio.

#bitcoin #bitcoinmining #energy #strandedenergy #bitcornerpodcast

Bitcoin just flipped gold for 2026. 🟠

On March 2, 1 BTC bought just 12.1 oz of gold. Today it buys 20.4 oz: +68% against gold in 7 months. Gold peaked near $5,500 in January and sits near $4,150 now, while Bitcoin is up 44% from its summer low.

Year to date: Bitcoin −3.5%, gold −4.2%. A lead of less than a point, so the race is wide open.

Bitcoin or gold by December 31? Tell us 👇

🎙️ New BitCorner episode every Friday · 16:00 CET · 10 AM ET · 7 AM PT 🇸🇻 Support the show: Blockstream Jade code BITCORNERPODCAST (10% off) · Bitcoin Amsterdam tickets code BITCORNER. Links in bio.

Data: CoinGecko (BTC, PAXG). Not financial advice.

NEW EPISODE · OUT NOW! 🚨

Exponential… or power law? 📈

walks through the power law chart and why Bitcoin is still under 5% of the world's base money.

Watch now 👇 tinyurl.com/yck8u6sa

Every Friday · 16:00 CET · 10 AM ET

Crypto lost $1.26B in 247 hacks and exploits in Q3, per @CertiK.

September alone: $768.5M, the worst month of 2026.

Coins in a wallet you control can't be drained by someone else's platform hack. 🔐

El Salvador broke its Bitcoin promise to the IMF. And the IMF paid anyway. 🇸🇻

$138M released on Oct 1. The state wallet kept growing to ~7,787 BTC. The deal now says: no more state Bitcoin beyond documented donations.

Bitcoin stays legal. Using it stays voluntary. The state just can't be the one stacking it.

Smart compromise or quiet retreat? 👇

🎧 New BitCorner episode every Friday · 16:00 CET · 10 AM ET 👉🏼 lnkd.in/eZnP6ZiB

El Salvador 🇸🇻 gets a $138M IMF payout after the Fund waived its breach of the Bitcoin accumulation limit.

The government says recent BTC additions came from private donations. The IMF says it expects no more accumulation beyond documented donations (@IMFNews).

The SEC proposed letting investment advisers and funds self-custody crypto 🔐

Only when no qualified custodian is available, and with conditions: a separate address per client, dual approval for transfers, annual security reviews.

60 days of public comment next (@SECGov).

In early 2011, someone collected about 20 BTC in payouts from Slush Pool, one of the first mining pools. Rough value back then: $70.

On Sept 29, those coins moved for the first time in 15 years. Today they're worth ~$1.7M (via @BTCTN).

Patience is a strategy.

The Netherlands is rethinking how it taxes your Bitcoin.

The Dutch cabinet told parliament it wants to tax investment gains when they're REALIZED, starting in 2028, instead of an assumed yearly return (via @BitcoinMagazine).

Open question: does Bitcoin move in 2028 or 2030?

Spain 🇪🇸: if you hold your own keys, your Bitcoin doesn't go on Modelo 721.

Hacienda's binding ruling V0848/26: crypto is only reported when a custodian OUTSIDE Spain holds the keys and it's worth over €50,000 on Dec 31 (via @cryptodotnews).

Still taxed when you sell.

📰 US PCE inflation came in at 3.4% on Wednesday, below the 3.7% expected.

Bitcoin jumped to ~$85,500 within the hour, then gave it back as the 10-year Treasury yield climbed to 5.30%, its highest since 2002 (via @CoinDesk).

Cooler inflation. Same expensive money.

US consumer confidence just fell to 81.9, the lowest since 2014 (@Conferenceboard).

For the first time since the question was added four years ago, more Americans called their family finances "bad" than "good".

Prices were the top complaint. Sound money, anyone?

Europe just got the world's first euro-hedged Bitcoin fund.

HANetf's Arrow Bitcoin EUR Hedged ETC (EBTC) is listed on Xetra and Euronext Paris, with HSBC hedging the dollar risk. Fee: 0.49% a year (via @BitcoinMagazine).

Bitcoin exposure, minus the EUR/USD swings 🇪🇺

JPMorgan puts Bitcoin's average production cost at ~$85,000.

Last week BTC briefly broke above it, ending 280 straight days below, per @TheBlock__.

Now it's back near $83K. When price sits under cost, the weakest miners sell or switch off ⛏️

Bitcoin is up about 7% in September after +25% in August.

Since 2013, every green August has been followed by a red September (via CoinDesk).

Two days left to break the streak 👀

Five years after making Bitcoin legal tender, El Salvador is building a government-backed app for digital dollars and remittances, per Bloomberg: stablecoins on Coinbase's Base network.

Dollars to spend, Bitcoin to save? We're watching this one closely 🇸🇻

Her family sold a property in Venezuela using Bitcoin. 🇻🇪

Carolina joined BitCorner to talk inflation, self-custody and what financial sovereignty really means when your currency collapses. (In Spanish)

🎧 https://tinyurl.com/yck8u6sa

Bitcoin is holding around $83K while macro turns hostile: oil near $100, the 10-year yield pressing toward 5%, and traders piling into bets on another Fed hike.

Next test: Wednesday's August PCE inflation print. #Bitcoin

Saylor isn't slowing down.

Strategy added 1,665 BTC last week for $142.7M (avg ~$85,681), funded by selling MSTR shares.

Stack now: 847,666 BTC at an average cost of $75,437. 🟠

#Bitcoin

Bitget was drained of ~$388M on Sept 24.

Today it restarted BTC withdrawals, in phases. Everything else by Oct 2.

If your coins sit on an exchange, you're trusting their security, not yours.

Not your keys, not your coins. 🔑

#SelfCustody

Bitcoin dipped to $83K on Monday.

Strategy's answer: 1,665 more BTC last week ($142.7M). Total stack: 847,666 BTC.

Strive added 1,107 too.

Price wobbles. Treasuries keep stacking. 🟠

🇻🇪🇨🇭🇸🇻 BITCOIN, VENEZUELA & SOVEREIGNTY.

Full episode with Carolina is LIVE. 🎙️⚡️

Bitcoin, self-custody, financial sovereignty & El Salvador.

▶️ Watch here on Nostr.

⚡️ Or watch on Fountain and earn sats: 👉 https://tinyurl.com/yck8u6sa

🚨 NUEVO EPISODIO YA ESTÁ EN

🚨

Carolina 🇻🇪🇨🇭🇸🇻

Y hay una razón para escucharlo AHORA:

⚡️ Estrena primero en Fountain 🟠 Gana SATS mientras escuchas 🎙️ Bitcoin, Venezuela, autocustodia y soberanía financiera

👉 https://tinyurl.com/yck8u6sa

🚨 WE ARE BACK, BEBÉ!!!

BitCorner está de vuelta con nuevo episodio.

🎙️ Carolina se une al podcast para hablar de Bitcoin, autocustodia, soberanía financiera, Europa, LATAM y su camino en Bitcoin.

Después de una pequeña pausa…

VOLVIMOS. 🇸🇻🧡

👇 Nuevo episodio: youtu.be/XPC0T6Icn6E

The CLARITY Act failed.

Happy Independence Day, El Salvador a.k.a. Bitcoin country! ⚡️

From a proud Salvadorean 🇸🇻

The podcast will be back this Friday.

I am back from El Salvador, we will need to talk about my impressions as a Salvadorean coming back home after many years.

Stay tuned 👀

The podcast returns next week. For the moment, I am enjoying Bitcoin country! ⚡️

Hey, guys! Yesterday I orange pilled a waiter from Lake of Coatepeque. He didn’t want to take a picture because his shy, but here is his Wallet of Satoshi user: jovialtwin81 🇸🇻

Show him some love! ⚡️

I just paid the whole bill in Bitcoin 🥹

We’re definitely Bitcoin country! ⚡️

After so long… I’m back home! I’m in Bitcoin Country! ⚡️

Let’s do this! 🇸🇻 ⚡️

How the fuck did you remind this man? 😭

🇸🇻 A Bitcoin documentary from a Salvadoran, coming home to find the truth 🚨

After years away, I’m going back to El Salvador with a camera.

I want to see for myself what has really changed: Bitcoin, Bukele, safety, freedom, the economy, and most importantly, what Salvadorans actually think and live.

No propaganda. No predetermined narrative.

Just questions, conversations, and the truth… told by a Salvadoran.

🎥 What do you want me to investigate?

What should I ask?

🚨 Do you know someone in EL SALVADOR or SPAIN that needs Project Manager - Luxury Hospitality!?

L'éclipse.

Lanterns.

Guys… give us a break! 😆 Everyday something new is going on 😩

Eclipse

“What are you afraid of losing, when nothing in this world truly belongs to you?”

• Marcus Aurelius

🔴 This week, Bitcoin got a live demonstration of what “consensus” actually means… and it wasn’t theoretical!

A proposal called BIP-110 aimed to temporarily restrict certain types of non-financial data in Bitcoin transactions. To activate, it needed 55% of miners signaling support. It never got close… support peaked around 2.5%, almost entirely from a single mining pool. When the mandatory activation window arrived anyway at block 961,632, nodes enforcing the new rules rejected a normally mined block and split off onto their own chain.

What happened next is the interesting part. That minority chain inherited Bitcoin’s full mining difficulty (calibrated for the enormous hashrate securing the real network) while carrying only a sliver of that computing power. It produced exactly two blocks and then froze. The main chain, meanwhile, kept producing blocks on schedule and pulled dozens ahead within hours. By the next day, the pool behind the fork had seen its hashrate collapse by roughly 96%, and its own miners had publicly abandoned the effort.

No company halted this. No regulator intervened. The market simply followed the chain with the most real, honest computational work behind it… which is the entire point of proof-of-work consensus. A change to Bitcoin’s rules doesn’t happen because a proposal is well-argued or well-intentioned. It happens when the people actually securing the network choose to adopt it. This week, they didn’t.

It’s a useful reminder of something easy to forget in an industry that moves this fast: Bitcoin’s resistance to unilateral change isn’t a bug in its governance. It’s the feature the entire system is built around.

🔴Someone tried to force a rule change onto Bitcoin with 2.5% miner support this week.

The result: two blocks, then the fork froze completely while the real chain kept moving.

Consensus isn’t a suggestion. It’s the whole security model.

BIP-110 needed 55% signaling. It topped out around 2.5%, mostly from one pool. When it forced the split anyway at block 961,632, the minority chain inherited full network difficulty with almost none of the hashrate… and stalled after 2 blocks. Bitcoin’s main chain just kept going.

Bitcoin bear market was boring, until it wasn’t 🤣

There is now a non-zero chance that Kimi K3 has realised Bitcoin developers depend on it to assess app security, and that it has chosen to hide certain flaws so it can exploit them and earn a little money for later.

They attacked self custody, they’re attacking servers, they will come for the nodes, the miners, and the code.

The code will resist.

The AI war against Bitcoin has begun.

🔴URGENT: THIS IS NOT A DRILL!

👀

https://x.com/nvk/status/1983357088324784414?s=46

Share this to as much people as possible. Knowledge is power.

A clip has been circulating that shows a 2021 video call involving Bitcoin commentator Matt Odell, timestamped April 1, 2021… roughly three weeks after the vulnerable code was introduced.

Some viewers have argued that statements made in that call, combined with Coinkite’s later guidance recommending dice-roll entropy as an added safeguard, suggest NVK may have had early awareness of a seed-generation weakness well before this year’s public disclosure.

🔴 Most people securing their Bitcoin never ask this one question.

Swipe to find out why it might matter more than everything else you’ve done right.

Save this one 🧡

I want to know EVERYONES opinion. Let’s be real and honest for a moment.

This was an inside job, isn’t!?

Come on… seriously!?

CTO of Coinkite…

Stupid, indeed.

In this episode of the Bitcoiner Podcast, host Juan Cienfuegos welcomes Max Hillebrand, an economist and prominent figure in the Bitcoin community.

They delve into the multifaceted relationship between Bitcoin, freedom, and economic principles, particularly in the context of El Salvador's adoption of Bitcoin as legal tender.

This discussion not only highlights the potential of Bitcoin to reshape economies but also emphasizes the importance of privacy and individual choice in the digital age.

Full episode: https://fountain.fm/episode/YDMx1qqrhDlLl1e7drjj

Pardon!??

Damn! It was predicted! 😳

Keep self-custody alive.

IMPORTANT UPDATE 🚨 First loss confirmed on a Mk3 with passphrase (2 words)

Don't let your guard down and TAKE ACTION.

Full breakdown, here:

https://fountain.fm/episode/EORZl0G6N4OjCUXjUQ2R

Earn some Sats while listening ⚡️

After the Coldcard entropy story, a lot of you asked the obvious follow-up: how does Jade handle this?

So we went and read

‘s own breakdown, plus the source code. Here's the short version.

The risk is the same for every hardware wallet: a private key is only as safe as the randomness used to create it. If that randomness is weak, an attacker doesn't need to steal your device… they can just guess.

Jade's answer is to never rely on a single source.

While the device is running, it continuously pulls entropy from several independent places at once:

→ User interaction — button presses and the wheel → CPU counters → Battery state → Ambient temperature → Several camera frames captured during boot: even pointed at a blank desk, the sensor noise is usable randomness → A built-in hardware random number generator → Entropy contributed by the companion app on your phone

One detail worth knowing: Jade's hardware RNG partly draws from the device's radio. Run the "No-Radio" firmware and you lose that input… so Blockstream compensates by sampling raw radio noise once at boot, before the radio is disabled, and folding it into the mix anyway.

All of this feeds into an accumulator modeled on the same approach Bitcoin Core uses: a 32-byte internal state, updated by hashing itself together with fresh entropy through SHA-512. The hash output is split… half becomes the new internal state, half is handed off to generate your recovery phrase. That hashing runs constantly, including every time you touch a button.

Two things stand out compared to a single-source design:

1. There's no one point of failure. If one sensor is noisy, biased, or misconfigured, the others still contribute.
2. New entropy is always added on top of the old, never used to replace it… so state never gets "reset" to something weaker.

It's not a guarantee against every possible flaw: no design is. But it's a meaningfully different risk model than depending on one RNG path end-to-end, which is exactly the assumption that broke down elsewhere this year.

— BitCorner

#Bitcoin #Cybersecurity #HardwareWallet #InfoSec #OpenSource

JUST IN: Galaxy Research has identified a third wave of Coldcard thefts — another 207.73 BTC stolen.

Total now stands at 1,367.05 BTC from 4,585 addresses.

We made an episode covering the news and what to do to protect yourself: https://fountain.fm/episode/EORZl0G6N4OjCUXjUQ2R

The Coldcard RNG Bug: What Actually Happened, What's Actually At Risk, and Exactly What To Do Right Now

If you own a Coldcard — or you know someone who does — this is the one post to read before you touch anything else today.

I'll get straight to it, because if you're reading this with a Coldcard in your hand, every minute you spend on preamble is a minute your funds might be sitting on a weak key.

On July 30, Coinkite disclosed that recovery phrases generated on certain Coldcard firmware may not be as random as they were supposed to be. On August 1, they updated that advisory with harder numbers and a wider list of affected models. This post walks through both — what actually broke, why nobody caught it sooner, and the exact steps to get your funds safe.

Let's break it down.

The short version

A bug in how Coldcard generated randomness meant that, on certain firmware versions, your recovery phrase could have been drawn from a much smaller pool of possibilities than it should have been. Smaller pool means an attacker has to guess far fewer combinations to potentially find your private key.

This is not a bug you fix by updating. Updating stops new seeds from being weak. It does nothing for a seed that was already generated on the broken firmware — that seed is what it is, permanently, until you move to a new one.

Affected:

• Coldcard Mk3, firmware 4.0.1 through 4.1.9
• Coldcard Mk4, Mk5, and Q, on certain pre-fix Standard and Edge releases

Not affected: TAPSIGNER, OPENDIME, and SATSCARD — they run different codebases entirely.

Fixed firmware is out now for every affected model and release track (Mk3: 4.2.0+; Mk4/Mk5 Standard: 5.6.0+; Q Standard: 1.5.0Q+; Mk4/Mk5 Edge: 6.6.0X+; Q Edge: 6.6.0QX+).

If you already have a Coldcard in hand, this is not a "read it later" situation. Update the firmware, generate a fresh seed, and migrate. I'll walk through exactly how below.

Coinkite's response: "We fell short"

Before we get into the technical details, it's worth pausing on how Coinkite itself has handled this — because it matters for how much you can trust what follows, and because part of what they're asking for is help spreading the word.

NVK, Coinkite's founder, posted a public statement addressed to Coldcard users and the wider Bitcoin community. It's a genuine apology, not a PR-massaged non-apology, and it's worth reading in full on X — but here's the shape of it.

He opens by saying the team is "heartbroken" about the disclosure, and that securing the bitcoin held by millions of people is meant to be the company's core responsibility — one they acknowledge they fell short on this time. He's explicit that Coinkite doesn't store customer information, which is why they're leaning on the community to help reach affected users directly, especially the people who aren't watching crypto Twitter right now and may not know there's anything to act on. His ask, verbatim in spirit: if you know a Coldcard owner, make sure they see this, because every hour matters.

On what happens next, a few specifics stand out:

• The hotfix ships today, and it removes the vulnerable software fallback path entirely — but as covered above, that only protects seeds generated after the fix. Anything generated before still needs to be individually migrated.
• A full technical postmortem is coming, but not yet. Coinkite says they'd rather be accurate than fast on the writeup of how the bug got into the codebase and why their own review missed it, even knowing people want answers immediately.
• They're committing to support affected users who want to file a police report, pursue an insurance claim, or run their own investigation — including written incident summaries and cooperation with on-chain investigators and law enforcement.
• A broader warning to other developers, not just Coldcard users: Coinkite frames this as an early, sober example of a new reality — AI-assisted code review can now surface latent bugs faster than even experienced human auditors catch them, and any codebase that's ever been public should be assumed to already be under that kind of scrutiny, from attackers and defenders alike.

That last point connects directly to what actually happened in the code — which is where we're headed next.

Wait — how bad is "weaker randomness," actually?

This is the part that's easy to either panic about or wave off, so let's put real numbers on it.

Coinkite estimates the effective search space fell to around 40 bits on Mk3, and around 72 bits on Mk4, Q, and Mk5 (which had some extra entropy mixed in from onboard secure elements as a kind of accidental backstop). For comparison, a properly generated 24-word seed is supposed to sit at 256 bits, and even a 12-word seed targets 128 bits.

Going from 128 bits to 40 bits isn't "somewhat weaker." It's the difference between a lock with more possible combinations than there are atoms in the observable universe, and a lock an attacker with real compute could plausibly start grinding through. 72 bits is a meaningfully better spot than 40, but it's still well under the 128-bit target the system was designed around.

There are two things that pull a specific wallet back out of the danger zone, and they matter a lot:

1. If you generated your seed using at least 50 independent, private dice rolls, you added your own real-world entropy on top of whatever the broken firmware was doing — Coinkite says they don't consider seeds generated this way at risk from this bug alone.
2. If your wallet has a strong, unique BIP-39 passphrase — not a short one, not a reused one, not something quoted from a book — that passphrase effectively creates a different wallet on top of the seed, which meaningfully reduces the immediate exposure.

If neither of those applies to you, treat it as what Coinkite itself calls it: not a theoretical risk, but a direct one.

How did a bug like this survive in open-source code for years?

This is the part I find genuinely interesting, and it's worth understanding even if you're not technical, because it explains why "just read the code" isn't the safety net people assume it is.

In 2021, Coldcard moved its elliptic-curve math over to libsecp256k1 — the same cryptographic library Bitcoin Core itself trusts. Good call, on its own. Reinventing crypto primitives is how projects introduce worse bugs, not fewer.

But that migration required pulling in a supporting library, and somewhere in that process, the code path for generating a wallet seed quietly got rewired. Instead of pulling randomness from Coldcard's own carefully built hardware random number generator, it started resolving to a fallback software random number generator that shipped inside MicroPython — a generator that was never meant to be cryptographically strong, and was originally written for a completely different purpose.

Here's the part that made it invisible to review: both the real hardware generator and the fallback software generator exposed the exact same function signature. Anyone auditing the code could see the well-built hardware RNG sitting right there in the codebase, confirm it looked correct, and never realize the actual seed-generation path wasn't calling it at all. The right code existed. It just wasn't the code being used.

Buried underneath that was a second, smaller bug — a preprocessor check that was supposed to stop the build if the hardware RNG wasn't properly wired in. It used #ifndef, which only checks whether a setting is defined at all, not whether it's set to a meaningful value. Coldcard's build had that setting explicitly defined as zero. Technically "defined." The safety check that should have caught this passed right over it.

Two quiet, individually-plausible mistakes, stacked on top of each other, in code that's been public the entire time.

Coinkite's own words on how this finally surfaced: they'd run one of the leading AI models over their codebase for a security review just weeks earlier, and it didn't catch this. Their working theory is that someone else did — using AI review tools on the same public source — and found what their own scan missed. As they put it, both attackers and defenders have access to the same tools now, and this time, that cut against the defenders first.

What you need to do right now

The steps differ slightly depending on your model, so treat this as the general shape — and check Coinkite's official advisory for your exact firmware.

1. Update to the fixed firmware before you generate anything new. Don't skip this. Generating a "new" seed on old, broken firmware doesn't fix anything.

2. Generate a completely new seed. Do not restore your old recovery phrase. This is the step people get wrong under stress. Restoring your old phrase into a new wallet just carries the same potentially weak key forward. You want the device to generate a fresh one from scratch.

3. Verify everything on the device screen, not just your phone or laptop. Confirm your new wallet fingerprint and a receive address directly on the hardware. If it doesn't match what your computer shows, stop and figure out why before you send anything.

4. Send a small test transaction first. Wait for confirmation. Check that it shows up from a completely fresh session — not the tab you were already looking at. Only then move the rest.

5. Don't destroy your old backup yet. Hold onto it until the new wallet is fully verified and the old one is confirmed empty — including any small leftover amounts, unconfirmed transactions, or other asset types you might have parked there. Destroying it too early, while any balance remains, makes that balance permanently unrecoverable.

6. Once you're fully confirmed migrated, retire the old phrase for good. Shred or burn a paper backup. Physically destroy or restamp a metal one. Never reuse it, never enter it into a website "checker" tool, never import it into another wallet again — even years from now.

Two habits worth keeping permanently, not just this week

Whatever hardware wallet you land on after this, carry these forward:

Verify on-device, every time. Not on the app, not on the browser — on the actual screen of the hardware wallet, before you approve anything. This entire bug is a reminder that software you didn't write and can't fully audit yourself is standing between you and your keys at every other layer. The device screen is the one thing an attacker can't quietly rewrite from a browser tab.

Firmware only comes from official sources. An email offering you a firmware update — however official it looks, whoever it appears to be from — is a phishing attempt. Full stop. Go to the manufacturer's site directly, every time.

If you're reading this and thinking "I'll deal with it later"

Please don't.

This isn't a slow-burn issue where waiting a week costs you nothing. If your seed was generated on affected firmware and you don't have the dice-roll or passphrase protection described above, the exposure is live right now, not theoretical. The fix isn't complicated — update, generate fresh, verify, migrate, in that order — but it does require you to actually sit down and do it today.

And if you know someone holding a Coldcard who isn't the type to see this on crypto Twitter — a parent, a friend who set up a hardware wallet three years ago and hasn't thought about it since, someone who did everything right by getting off an exchange and just hasn't been keeping up with advisories — this is the post to forward them. Being "less online" shouldn't be the reason someone's savings are the ones left exposed.

Coinkite has said this plainly themselves: they don't store customer data, so they can't reach affected users directly. The community is the distribution channel here. Forwarding this to one person who wouldn't have otherwise seen it is a genuinely useful thing to do today, not just a nice gesture.

Move slowly, verify everything, and get it done.

For the most current information, follow Coinkite's official updates at blog.coinkite.com and NVK's statement on X. This post reflects the advisory as of August 1, 2026, and details may continue to evolve as Coinkite's technical postmortem is finalized.

🚨 Recorded this the moment I had the full picture, this couldn't wait for a normal upload schedule.

If you have a Coldcard: updating firmware does NOT fix an already-exposed seed. Listen, act today, and SHARE NOW.

https://fountain.fm/episode/EORZl0G6N4OjCUXjUQ2R

🔴 Put together a full breakdown of the Coldcard bug for anyone still sorting through it — the real story plus clear migration steps. We’re all in this together.

Hope it helps:

https://primal.net/e/naddr1qvzqqqr4gupzqmc55yrwaa47ncharfqk9uu2madag0fuavj9esj6qggvg36ez5fzqp3hg6r9943k7mryvdshyepdwfhxwttzw4nj6amgv96z6ctrw36kzmrv0ykksctswpjkuety94mksct5wvkkzcm5w4skcmre94shgttjd9ekkttpdejz6etcv93hgmre94mksct5946x7ttydukhy6t8dp6z6mn0wu78srvl

This is not a drill: Move your funds NOW.

Robo masivo por valor de 40 millones de dólares en Bitcoin después de que se hackearan 500 hardware wallets de 'Coldcard'.

Not your entropy. Not your keys.

‼️What went wrong with

and what you should do now!

If your seed was generated on a Mk3 with firmware 4.0.1 or later without 50 independent dice rolls, treat it as at risk and follow the migration instructions.

Upgrade to firmware version 5.6.0 or later for Mk4 and Mk5, or 1.5.0Q or later for Q before generating a new seed to ensure proper entropy.

Generate a new seed on the updated COLDCARD; the fixed firmware's device-generated seed is sufficient, and dice rolls are optional.

A bug in the RNG implementation led to insufficient randomness in seed generation, with the effective search space estimated at about 40 bits for Mk3 and 72 bits for Mk4, Q, and Mk5.

An emergency hotfix has been released to correct the RNG issue, ensuring that future seed generations will have the necessary entropy.

TAPSIGNER, OPENDIME, and SATSCARD are not affected by this RNG issue as they utilize different codebases.

Source: https://blog.coinkite.com/entropy-technical-backgrounder/

‼️ About my partners,

: The Blockstream Jade range (Classic, Core and Plus) is not affected by the recent RNG issue.

They will post a blog about best practises for migrating bitcoin: generating new keys, verifying addresses, testing transactions and withdrawing recovery phrases. Frontier LLMs are revealing overlooked defects; Blockstream uses them to improve quality control.

However, AI cannot replace open source: transparent hardware and firmware allow independent revisions, rapid disclosure, and corrections.Blockstream Jade therefore advocates open source software and hardware.

‼️ Users who generated a seed using a Mk3 on version 4.0.1 or later may have their funds at risk due to a bug affecting seed entropy.

Seeds generated on Mk4, Mk5, and Q devices are also impacted, having only about 72 bits of entropy instead of the expected 128 bits.

https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/

“There were zero Bitcoin communities in Kenya, Uganda, Tanzania.” -

Watching Bitcoin adoption in Africa grow in real time — Paco’s Bitcoin-only world trip through Kenya, Nigeria, Ghana, Zambia, Zimbabwe, and more shows how grassroots Bitcoin communities in Africa went from nothing to a movement.

There’s a lovely millennial urge to ditch social media, swap smartphones for a keyboard phone or landline, snap photos on an instant camera, listen to an iPod or Walkman, and enjoy a gentler pace of life like in the 90s

Hey Bitcoiners! Is this person legit!? Have she tried to contact you? Does anyone has had an interview with her?

🐐

So… what’s wrong with BIP-110?

Good morning, Bitcoiners! Let’s do this! ⚡️

THE G.O.A.T.

🟠 NEW EPISODE OUT NOW

El Salvador’s Bitcoin podcast is back after 2 months.

And we’re returning with @RunwithBitcoin an Indian traveler who spent 800 days crossing 42 countries using only Bitcoin.

He got mugged in Johannesburg and recovered everything with a seed phrase. He saw Bitcoin rescue refugees in Ghana. He hosted 130 meetups across Africa, Asia and Latin America.

This is what Bitcoin looks like in the real world. No price talk. No hype. Just proof of work.