Coldcard

Liquid Network Federation Wallet Drained of 4000 BTC in Alleged White-Hat Exploit Exposing L-BTC Minting Flaw

On September 7, the Liquid Network sidechain suffered a major incident where its Federation wallet lost approximately 4000 Bitcoin, worth around $320 million or 2.1 billion RMB, leaving only 200 BTC behind. The funds were moved through the authorized SideSwap settlement platform using PAK keys without any reported key compromise. Liquid officials described the actor as a claimed white-hat hacker intending to return assets for a fee, but security experts point to a critical vulnerability allowing unauthorized L-BTC minting that could bypass the 1:1 Bitcoin backing mechanism. The network has halted all new transactions while federation members work on remediation, affecting major platforms including BTSE, Bitfinex, and BitMEX. This event aligns with a broader 2026 trend where attackers target protocol-level asset issuance rather than individual keys, as seen in recent Coldcard RNG flaws and other incidents totaling $972 million in crypto thefts. The case underscores weaknesses in multi-signature federation validation and cross-chain anchoring that go beyond traditional smart contract bugs.

Researchers Expose GPON Optical Network Eavesdropping via Modified ONU Devices at DEF CON

At DEF CON 34, two researchers demonstrated how inexpensive hardware modifications allow interception of downstream traffic in GPON fiber networks shared among multiple subscribers. The passive optical design means all clients connected to the same splitter receive identical data streams, with separation handled only at the ONU level through 12-bit GEM port identifiers. By acquiring Realtek RTL960x-based SFP modules and systematically bypassing built-in restrictions on GEM port reassignment, VLAN tagging, switch forwarding, and checksum validation, the team achieved access to traffic intended for up to 128 neighboring users. Exposed data includes DNS queries that can reveal occupancy patterns, unencrypted SIP voice traffic, and in some cases traffic from nearby cellular base stations. The researchers also identified exploitable vulnerabilities in the VSOL G100S OLT device that could grant root-level control and compromise provider routers. Additional coverage in the same Kaspersky report examined Head Mare's compromise of TrueConf servers, EvilFontTool font-based evasion, an OpenAI presentation on an accidental AI attack against Hugging Face, and the SCTPhantom Linux kernel flaw present for 18 years.

COLDCARD Wallets Suffer Mass Crypto Theft After RNG Flaw Allows Seed Reconstruction

A critical implementation error in COLDCARD hardware wallets enabled attackers to reconstruct wallet seeds and steal cryptocurrency from thousands of users. The flaw stemmed from an incorrect switch to the libsecp256k1 library, which inadvertently used the rng_get() function from libNgU for seed generation instead of proper hardware entropy. Depending on the model, seeds for Mk2 and Mk3 devices could be derived solely from UID, timer state, and generator history, while Mk4, Mk5, and Q models added limited extra entropy. On July 30, the attacker drained over 1,367 BTC worth approximately $88 million from 4,585 addresses in just 41 minutes. Coinkite released updated firmware, but affected users must also regenerate new seeds and consider additional protections such as passphrases. Other Coinkite products including TAPSIGNER, OPENDIME, and SATSCARD remain unaffected. The incident highlights how even well-tested cryptographic libraries can fail when integrated incorrectly.

Coldcard Firmware Flaw Linked to Theft of 1,082 Bitcoin in 41 Minutes

A critical defect in COLDCARD firmware degraded entropy during BIP39 seed generation, enabling offline enumeration of weak seeds and resulting in the theft of 1,082.65 BTC from 1,196 addresses in just 41 minutes on July 30, 2026. The root cause traces to a March 2021 integration error that replaced the STM32 hardware RNG with a deterministic software PRNG initialized only by chip ID and timing registers, yielding roughly 40 bits of effective entropy on Mk3 devices and 72 bits on Mk4, Mk5, and Q models. Coinkite issued emergency firmware updates, yet any seed created on vulnerable versions remains exposed regardless of later updates. Additional sweeps matching the same pattern have raised total observed losses to 1,367.05 BTC across 4,585 addresses. Users must generate fresh seeds on patched firmware and migrate funds immediately; dice-based entropy addition or BIP39 passphrases provide only partial mitigation.