Bitcoin Brief

Sup, freaks.

A reminder for anyone with bitcoin on a COLDCARD: We advise moving that bitcoin with urgency, either to a new wallet with freshly generated keys or to a custodial service you trust.

Let's get into it.

LEAD STORY

The COLDCARD Disaster Has Reached Nine Figures

The COLDCARD disaster is worse than it looked when we sent Friday's emergency edition.

Galaxy Research's August 3 investigation tracks 1,596 BTC from roughly 7,300 addresses across three major theft waves and 14 smaller incidents. At this morning's bitcoin price, that is approximately $101.5 million.

Galaxy's attached category chart showed 1,590.90 BTC across the three large waves and smaller owner-confirmed footprints. That is roughly 5 BTC below its headline figure, likely because the investigation was still moving while the thread was assembled. We are not going to pretend the difference does not exist. The clean number is Galaxy's latest formal estimate: 1,596 BTC in the high-confidence set.

A larger suspected set reaches approximately 2,054.90 BTC, worth roughly $130.7 million this morning. That figure includes pattern-matched activity and a candidate fourth wave that had not been confirmed by affected owners when Galaxy published its chart. It should not be described as 2,055 BTC of confirmed COLDCARD theft.

The confirmed number is catastrophic enough.

Alex Thorn reported this morning that Galaxy now estimates at least 15 distinct attacker patterns are exploiting the public weakness. A victim who reported losing less than one bitcoin led investigators to Footprint O, a previously unidentified pattern that Thorn says drained 12 BTC from 126 addresses.

The estimate does not mean 15 named people have been identified. Galaxy is separating activity by transaction patterns. One person could operate more than one pattern, and one pattern could represent a coordinated group.

Thorn says roughly 80 victims have now contacted Galaxy directly. Those reports are central to the investigation because dispersed thefts do not begin at one obvious exchange or protocol address. Galaxy keeps a broader triage list ranging from low-confidence candidates to high-confidence thefts and only adds activity to its headline count when the evidence is strong, often after a victim confirms the affected addresses.

The large waves remain highly visible. Waves 1 through 3 moved 1,367.05 BTC, and Galaxy says all of those coins were still parked at their tracked holding addresses. Wave 1 consolidated through a small number of funnels. Wave 3 split the theft into hundreds of staging and holding addresses, creating a much messier graph.

The smaller operators are already moving differently. Thorn says some have used peel chains, THORChain, and offshore casinos. In one documented case involving the gambling platform Duel, Thorn said the platform identified a depositor, but the bitcoin had already left before it could be frozen.

Galaxy says it has shared roughly 600 suspected attacker addresses with federal investigators, exchanges, compliance firms, SEAL, and cyber investigators. No public seizure, return, arrest, or successful freeze has been announced. The coins sitting still are traceable. They are not recovered. The attackers still control the keys.

The root failure remains the one Coinkite confirmed last week. Affected COLDCARD firmware reached a deterministic MicroPython fallback instead of generating the expected randomness from hardware. Block's Bitcoin Engineering and Security team independently identified the same vulnerable path.

Bitcoin's cryptography was not broken. The private keys were born weak.

The most exposed seeds were generated by Mk2 and Mk3 devices running version 4 firmware. Coinkite estimates that the affected Mk3 path could leave roughly 40 bits of effective search space under its attack assumptions. Coinkite also says seeds generated on Mk4 and Mk5 before firmware 5.6.0, and on Q before 1.5.0Q, may have roughly 72 bits of entropy rather than the intended 128 bits.

A firmware update prevents fixed hardware from repeating the mistake. It cannot add entropy to words that already exist. Restoring the same seed onto a new device does not repair it either.

Matt Odell and I recorded Rabbit Hole Recap #421 yesterday to address what happened. We deeply apologize for endorsing COLDCARD. We are trying to hold ourselves accountable right now and make sure we internalize these lessons moving forward.

I have been praying about this a lot since Thursday night. Accountability does not mean softening the facts. It means telling the truth, owning my recommendation, and making sure the lessons change how I act moving forward.

The COLDCARD disaster has reached nine figures. The theft is ongoing, the attacker set is growing, and the full technical and organizational history is still coming into view.

SIGNAL

AI Has Collapsed Bitcoin's Patch Window

Rob Hamilton says the Bitcoin Red Team has scanned 150 repositories, made more than a dozen disclosures, and spent roughly $20,000. Kimi K3 is doing much of the heavy scanning, with additional models helping document and reproduce findings. Calle says the effort is finding vulnerabilities at a frightening rate while OpenSats is footing the bill.

The numbers are participant-reported, and Rob warns that some Kimi output is “slop, overstated, or wrong.” That caveat matters. AI can produce false positives as quickly as real findings. Humans still have to reproduce the exploit, judge severity, contact the right maintainer, and coordinate a safe release.

Speed is the enduring change. Security teams are no longer limited by how many files a specialist can read in a week. Attackers are not limited either. Bitcoin's disclosure and maintenance systems now need to operate at machine speed without surrendering human judgment. The Bitcoin Red Team will be an imperative moving forward.

Boltz Paused Swaps Before the Asymmetry Got Worse

Boltz paused its swap services until further notice after reporting months of automated, AI-assisted probing and several contained exploits. It says attackers began iterating faster than its small team could find and patch weaknesses. Boltz says user funds were never at risk and that the losses were its own.

The company did not disappear. Its cooperative refund API and support remain available, and unilateral refunds do not depend on Boltz infrastructure. BULL Wallet confirmed that Lightning send and receive, plus Liquid-to-Bitcoin swaps, were affected while on-chain Bitcoin, Liquid transfers, and recovery remained available. AQUA's Boltz-dependent swaps were unavailable while other routes kept working.

Boltz has not published exploit details, attacker attribution, or a technical postmortem. There is no public evidence that Hamilton's red team caused the pause. The connection is structural: machine-speed offense is forcing lean infrastructure teams to reconsider whether they can remain online safely.

Treasury Needs More Cash Than J.P. Morgan Expected

J.P. Morgan's August 3 Treasury report says federal financing needs over the next two quarters are $127 billion above the bank's estimate after adjusting for different Treasury General Account assumptions.

Treasury projects $739 billion of net privately held marketable borrowing from July through September and $628 billion from October through December. Most of J.P. Morgan's forecast gap sits in the fourth quarter. The bank sees modest upside risk to its $1.96 trillion fiscal 2027 deficit forecast, while noting that year-end cash-flow seasonality may explain some of the difference.

More Treasury issuance does not dictate bitcoin's next move. It does add supply to a financial system already balancing deficits, dollar funding, inflation, and duration risk. The government keeps financing itself through expanding claims on future dollars. Bitcoin keeps settling with a fixed monetary schedule.

The AI Backlog Is Growing Faster Than the Capex

The latest Market Ear banking packet estimates that Big Tech's AI and data-center backlog has reached roughly $1.7 trillion, up approximately 150% year over year, while capital spending has increased about 80%.

Amazon, Alphabet, Meta, and Microsoft are projected to spend more than $660 billion in 2026 and approximately $790 billion in 2027. The report argues that the buildout is increasingly supported by customer commitments and operating cash rather than speculative debt alone. It projects combined free cash flow around $640 billion this year and $830 billion next year.

These are sell-side estimates, not company guidance. Backlog is not cash, recognized revenue, or guaranteed utilization. The useful signal is that demand commitments are still growing faster than physical deployment. AI is competing for power while making vulnerability discovery dramatically cheaper. Bitcoin is now exposed to both sides of that acceleration.

Jessica Rose Maps the Gates-Fauci Pandemic Network

Jessica Rose's new article argues that the Proximal Origin paper became the scientific keystone for locking the public into a natural-origin explanation for SARS-CoV-2 while institutions accelerated vaccines, testing, contact tracing, and reopening policy.

Rose centers the piece on Bill Gates's April 2020 pandemic memo to Anthony Fauci, Fauci's conversations about cooperation among the Gates Foundation, NIAID, and BARDA, and the private uncertainty surrounding the scientists who produced Proximal Origin. She also traces Ian Lipkin's place among the paper's authors, his relationships across public health and intelligence circles, the authors' private Slack messages, and their hostility toward scientists who kept the lab-origin question open.

Her thesis is that Gates supplied the global vaccination objective, Fauci and Collins helped steer the institutional response, and Proximal Origin supplied the authoritative narrative needed to suppress questions about engineering and laboratory origin. Read the full piece for Rose's document trail and argument.

⚡ FREEDOM TECH CORNER

MARA Opened a Private Lane Around the Sweepers

The public mempool can become an attack surface when a vulnerable wallet finally spends.

A transaction can reveal its script and public keys before it confirms. If those keys were generated from weak seeds, an attacker can construct a conflicting transaction, attach a higher fee, and try to replace the original spend.

MARA has opened Slipstream as a permissionless public good, with no additional service charge beyond the normal mining fee. Slipstream lets a user submit a signed raw transaction directly to MARA's pool rather than broadcasting it into the public mempool first.

Direct submission narrows the window in which an attacker can see the transaction details and respond. It does not make the transaction invisible forever, guarantee that MARA mines the next block, or prevent a conflicting public transaction from winning somewhere else.

The response is one factual example of mining infrastructure adapting in real time while attackers continue to exploit the weak keyspace, without taking custody of users' bitcoin.

DATA SNAPSHOT

As of August 4, 2026, 9:57 a.m. ET

See you tomorrow. This is not investment advice. Do your own research.

YouTube: https://www.youtube.com/@TFTC

podcast: https://www.tftc.io/tag/podcasts/