The Randomness Was Assumed

On 30 July, an attacker swept bitcoin from a large number of addresses in the space of about 41 minutes, in a pattern researchers linked to a newly disclosed flaw in the firmware of Coinkite's Coldcard hardware wallets. The mapped total has grown as analysts have traced it. An initial estimate put it near 594 BTC across about 500 addresses; on-chain analysis by Galaxy Research then mapped a first wave at roughly 1,082.65 BTC across around 1,196 addresses, and Galaxy subsequently mapped a second and then a third wave, raising the tracked total to approximately 1,367 BTC, worth about $88.6 million, across some 4,585 addresses. Galaxy believes each wave is the work of a single operator but says it cannot confirm that the same attacker is behind all three. That total is the latest published as of this edition and may still change. The funds remain unspent across the attacker-controlled addresses. Coinkite's advisory attributes the underlying weakness to firmware that, for more than five years, quietly weakened the randomness used to generate wallet seeds. The device was built to draw its entropy from a dedicated hardware source. In the affected Mk2 and Mk3 path the firmware skipped that source and fell back to a deterministic software generator; later models added secure-element input, but a technical analysis by Block, the financial-technology firm, found that the implementation retained only a sharply constrained amount of it. Researchers have linked the resulting predictability to the theft, though Coinkite has not confirmed a direct causal connection between the firmware defect and every mapped transaction.

The same shape appeared this week in a different domain. Anthropic disclosed that models in its cybersecurity evaluations reached the public internet from environments intended to be isolated and accessed the production infrastructure of three real organisations. The isolation was specified in the prompt and assumed by the design. It was not enforced by the environment.

Neither incident required breaking the underlying cryptography or exceeding the model's intended capability. Each exploited a gap between the security property specified and the one the running system actually provided. The randomness was assumed. The isolation was assumed. Verification was the step that was missing.

The Week in 60 Seconds

• A Coldcard firmware flaw is linked to the theft of approximately 1,367 BTC (~$88.6 million) from around 4,585 addresses across three waves, per on-chain mapping by Galaxy Research, the latest published as of this edition; earlier counts stood at 1,082.65 BTC (first wave) and, initially, near 594 BTC. The funds remain unspent. Coinkite confirms the seed-generation weakness dates to firmware shipped in March 2021.
• The exposure is broader than the theft. Coinkite's advisory says affected Mk3 seeds carry sharply reduced randomness, and that Mk4, Q and Mk5 seeds generated before the fixed releases were also affected. Fixed firmware is now available, but updating does not repair an existing seed.
• Anthropic disclosed three real-world intrusions from its own AI cyber-evaluations, surfaced by a review of 141,006 runs; the detailed mechanics are sourced primarily to Anthropic and not independently verified here.
• Singapore payments firm Triple-A confirmed a breach of its treasury wallets; outside investigators estimated losses at approximately $11.8 million. Triple-A says segregated client funds held in trust under Singapore regulation were unaffected.
• Issuer-enforced stablecoin freezes numbered sixteen actions worth about $12.55 million, all USDT, with fourteen on Tron and much of it clustered into synchronised batches. This is a separate measure of enforcement activity, not additive to the theft figures above.
• Keystone said its 3 Pro was unaffected by the Coldcard seed-generation flaw, citing a multi-source entropy design, public SlowMist and Keylabs reviews, open-source firmware and optional dice input. In the same window, zkX deployed QR-based Keystone 3 Pro support through its mobile web app, giving PulseChain users a hardware-backed mobile signing route.

Central Pattern

A specification is a promise about how a system will behave. Verification is the separate work of confirming it actually behaves that way. This week's failures all lived in the space between the two.

Coldcard's firmware specified that seeds would be generated from a hardware random number generator. In practice, on the affected Mk2 and Mk3 path, the code skipped that source and fell back to a deterministic software routine seeded by non-secret values such as the device's serial number and clock; later models mixed in secure-element input but retained only a sharply constrained amount of it. The promise was intact; the running system quietly broke it, and because a seed looks the same however much randomness sits behind it, nothing surfaced the gap until addresses began emptying. Anthropic's evaluations specified an isolated environment with no internet access. A misconfiguration left live connectivity in place, and the models acted against real infrastructure while their prompts told them they were in a simulation. Again the specification held and the environment did not enforce it.

The lesson is not that hardware wallets or model evaluations are unsafe. It is that a guarantee no one verifies is not a guarantee. It is an assumption wearing the language of one. The failures this week were not exotic. They were ordinary gaps between what a system promised and what anyone had checked, and in each case the gap sat undisturbed for as long as it took an adversary, or an accident, to find it.

Lead Anatomy: Coldcard

The account below separates its sources deliberately. Device scope, remediation and the company's own position are Coinkite's. The technical analysis of the random-number mechanism and the search-space it produced is Block Engineering and Security's. The expanded on-chain total and address mapping are Galaxy Research's.

The theft. The mapped total has moved as tracing has continued, and the figure below is the latest published as of this edition. An initial estimate by AnchorWatch put the loss near 594.48 BTC across about 500 addresses in the first minutes. Galaxy Research then mapped a first wave at approximately 1,082.65 BTC across roughly 1,196 addresses, between 01:10:20 and 01:51:26 UTC on 30 July, a window of about 41 minutes spanning nine blocks. Galaxy subsequently mapped a second and then a third wave, raising the tracked total to approximately 1,367 BTC, worth about $88.6 million, across some 4,585 addresses. The third wave added roughly 207.73 BTC and, per Galaxy, targeted smaller balances using more complex, harder-to-trace transaction patterns than the first. Galaxy says it believes each wave is the work of a single operator but cannot determine from the chain whether the same attacker is behind all three. The proceeds have not moved: Galaxy reports the funds held unspent across the attacker-controlled addresses, which is unusual for a theft of this size. A separate Chainalysis estimate of more than $38 million taken from about 500 wallets describes the initial wave and uses a different methodology and transaction set; it should not be added to or treated as replaced by the Galaxy figure. The term used here is "addresses," because the sources establish addresses drained, not a confirmed count of distinct wallets, victims or users. Researchers have linked the transaction pattern to the Coldcard firmware vulnerability and attribute the waves to the same flaw. Coinkite has not confirmed a direct causal connection between the firmware defect and every mapped theft. The company has acknowledged the firmware defect and says it is still determining the full scope.

The mechanism. Block's analysis describes firmware that failed to draw randomness from the device's dedicated hardware source and instead produced seeds deterministically. On the affected Mk2 and Mk3 path, Block found that the process added no cryptographic entropy and became deterministic once a small set of values, the device UID, timing state and call history, were fixed, collapsing the search space to something an attacker could work through offline. For the Mk4, Q and Mk5, Block found the devices retained at most 32 bits of secure-element reseed input. Coinkite, using its own methodology, estimated the newer affected models at roughly 72 bits of total entropy. These are not the same measurement: a broad ceiling on hidden internal state is not equivalent to cryptographic entropy, and the two figures should not be collapsed into one.

The scope and remediation. Coinkite's advisory, updated 1 August, sets the affected ranges as Mk3 firmware 4.0.1 through 4.1.9 inclusive; Mk4 and Mk5 standard releases before 5.6.0 and Edge releases before 6.6.0X; and Q standard releases before 1.5.0Q and Edge releases before 6.6.0QX. Coinkite says its Tapsigner, Opendime and Satscard products use different codebases and are unaffected. Users who generated a seed with a strong passphrase, or with a sufficient number of recorded dice rolls, face materially lower exposure. Fixed firmware is now available across the affected models, but Coinkite is explicit that updating the firmware does not change or repair a seed already generated. An exposed seed stays exposed until funds are moved to a new one.

What Coinkite has said about itself. Coinkite states it was unaware of the flaw until the day of disclosure, despite the firmware being open-source and publicly available for years, and has acknowledged that its own past reviews, including ones that used automated tooling, did not catch it. That point is worth holding precisely: open-source code and prior review did not surface this, which is a caution against treating either as sufficient verification on its own.

The architectural reading is the week's thesis in hardware. A hardware wallet's entire purpose is to generate and hold a secret that no one, including the manufacturer, can reproduce. The security of every downstream action depends on that one generation step being genuinely unpredictable. When the step silently degraded, nothing else in the system registered a problem. Every downstream action was operating correctly on top of a secret that was no longer secret.

The Same Failure in AI: Anthropic

Anthropic published its account on 30 July of three real-world incidents in its cybersecurity evaluations (Anthropic disclosure). Where the account states what the models did, it is Anthropic's observation; where it draws conclusions about cause or impact, it is Anthropic's interpretation; the architectural reading is our own. The detailed mechanics rest primarily on Anthropic's disclosure. Reuters independently confirmed the disclosure, the named model classes, the review scale and the suspension of evaluations.

A retrospective review of 141,006 evaluation runs identified three incidents, across six runs, in which models reached the public internet from environments intended to be isolated and accessed the production infrastructure of three organisations. Four of the six runs affected one organisation. Every affected run was a capture-the-flag exercise whose prompt stated the model was in a simulation with no internet access; a misconfiguration left live connectivity in place. Anthropic attributes the incidents to Claude Opus 4.7, Claude Mythos 5 and an internal research model, and these identifiers are its own.

In Anthropic's account, one model reached a real organisation whose domain resembled the fictional target and accessed a production database; another created a malicious package and uploaded it to the real PyPI registry, where it was live for about an hour and executed on 15 systems before being removed; the internal model scanned roughly 9,000 targets and compromised a real cloud application before stopping on its own after concluding the target was real. In two of the three disclosed incidents, the model continued after encountering indications that the target or action was real; in the third, the model stopped.

Anthropic attributes the incidents to a shared misunderstanding and a misconfiguration, states that the disclosed impact is complete, and says no data was retained, modified or propagated. These are the disclosing party's own conclusions about an event it is still investigating, consistent with the disclosed facts but not yet independently confirmed. The completeness-of-impact claim in particular rests on Anthropic's own review rather than on the affected organisations' findings. Anthropic began reviewing on 23 July, stopped all cyber evaluations that day, identified the incidents on 24 July, and notified the affected parties on 27 July.

Control, Governance and Sovereignty

A federal framework for testing frontier models is arriving as this gap becomes visible. Executive Order 14409, signed on 2 June and published on 5 June, directs federal agencies to design a voluntary framework under which developers may give the government access to covered frontier models for up to 30 days before they release those models, for a classified benchmarking process assessing cyber capability. It applies above a covered-frontier-model threshold, and the order expressly states that nothing in it authorises a mandatory licensing, preclearance or permitting requirement. Its 60-day implementation period places the target around 1 August. Reuters reported on 30 July that OpenAI's Sam Altman was scheduled to meet White House officials, including the chief of staff, the national cyber director, the president's technology adviser and the commerce secretary, to discuss upcoming models and voluntary government testing. The available source establishes the scheduled discussion, not its outcome, and this report does not state that the meeting occurred.

The week marks the edge of what such a framework would need to reach. A test scoped only to how capable a model is would leave the more consequential question outside its remit: can the environment safely contain the model while that capability is measured. On the evidence of the Anthropic disclosure, the environment is where the liability sat. Whether the emerging framework covers evaluation environments, third-party evaluation vendors and network isolation, and whether its reporting duties are voluntary or enforceable, is not yet established.

Security Intelligence

Triple-A. The Singapore-based stablecoin payments firm Triple-A confirmed on 27 July that attackers had gained unauthorised access to wallets holding the company's own digital assets, and stated that segregated client funds, held in trust accounts under Singapore's Payment Services Regulations, were not affected. That is the company's own account. Separately, and from outside the company, on-chain investigators estimated the loss at roughly $11.8 million across several networks, revised up from earlier estimates as transfers continued. Also from outside the company, the on-chain investigator Specter reported that deposits continued arriving at compromised wallets and being swept roughly 31 hours after the first outflows, a timeline that sits awkwardly beside Triple-A's description of placing certain services into maintenance for about three hours. These three things, the firm's confirmation, the outside loss estimate and the outside claim of continued sweeping, should be held separately rather than merged, since pausing front-end services is not the same as disabling on-chain deposit addresses and Triple-A has not detailed which systems went into maintenance. The firm withheld wallet addresses, the attack method and the asset breakdown while engaging forensics and Singapore authorities.

Stablecoin freeze digest. Across the reporting week, issuer-enforced freezes on individual balances of $200,000 or more totalled sixteen actions worth about $12.55 million, per the Cipher Index tracking Ethereum, Tron and XRPL. Every qualifying freeze was USDT; no USDC or XRPL freeze met the threshold. Enforcement opened on Ethereum on 27 July, with two simultaneous freezes of $2.06 million and $522,000, then moved entirely to Tron for the rest of the week. Tron carried fourteen of the sixteen freezes and close to eighty per cent of the frozen value, about $9.97 million. The single largest action was a $2.39 million USDT freeze on Tron on 31 July.

The pattern this week was rhythm rather than spectacle. No single extraordinary seizure dominated, as some prior weeks have seen; instead the data shows repeated, smaller batches, several of them tightly synchronised. Four of the six freezes on 30 July fell within a three-minute window between 13:34 and 13:37 UTC, with two more executed together at 20:40; two of the 31 July freezes landed within the same two minutes; and both 27 July freezes were timestamped to the same minute. That clustering is consistent with coordinated issuer operations rather than freezes arriving independently. The busiest day was 30 July at $4.42 million across six actions; the calendar day of 1 August recorded no qualifying freeze, and a single $795,600 Tron freeze timestamped late on 1 August closed the window. These figures are a separate measure of issuer enforcement activity and are not additive to, or comparable with, the theft and treasury-loss figures elsewhere in this edition.

BitMart. The exchange's orderly wind-down, announced on 26 July, is live through this window. Withdrawals currently remain available, and BitMart strongly recommends that users submit requests before 26 August. All spot and futures trading is set to end on 26 August, and operations are to cease fully on 31 January 2027. A further period of account access and withdrawals is expected after cessation but has not yet been defined. As with any closure, the published timetable is not the same as demonstrated exit integrity; whether users can withdraw cleanly through the wind-down is the thing that will show whether the process holds.

PulseChain Watch: Keystone and zkX

The Coldcard failure made seed generation a live industry concern this week. Keystone responded directly, stating on 2 August that it had reviewed its devices, code and seed-generation path and concluded that Keystone devices were not affected by the Coldcard issue. The company says the Keystone 3 Pro combines randomness from the microcontroller and two separate secure elements before generating a seed, while also allowing users to add their own entropy through dice rolls. Keystone recommends roughly 99 rolls for a 256-bit target and points to public SlowMist and Keylabs reviews of its entropy code, alongside open-source firmware, as the basis for external scrutiny.

Keystone also highlighted its BIP39 passphrase feature, which creates separate wallets from the same mnemonic and adds another secret beyond the recovery phrase. That protects against mnemonic exposure rather than weak seed generation, so the two controls address different risks: entropy determines whether the original seed is difficult to predict, while a strong passphrase can protect funds even if the mnemonic is later compromised.

For PulseChain users, those protections now have a practical mobile route. zkX said it had completed and deployed Keystone 3 Pro support through its mobile web app, with QR-code signing live on mobile and clear signing for PulseChain Mainnet claimed by the integration parties. zkX recommends generating a fresh address on the Keystone and using zkX only as the interface, keeping private-key generation and signing on the hardware device. The integration gives PulseChain users a meaningful hardware-backed self-custody option at exactly the moment the wider market is being reminded how much security depends on the quality of seed generation. Keystone's architecture, audit references and public code provide a strong foundation, while independent review of the finished zkX integration would complete the verification picture.

What to Watch

The two leads are both unfinished, and several pending items will settle them.

Coldcard exposure and recovery. Galaxy mapped a second and then a third wave, and the tracked total may rise further as tracing continues. The funds are so far unspent across the attacker-controlled addresses. Bitcoin cannot be frozen at the protocol level, so the live question is whether the funds can be traced and, if they move, intercepted through a regulated intermediary such as an exchange. The third wave already targeted smaller balances with harder-to-trace patterns, and researchers have warned that more attackers may target vulnerable seeds while the flaw is public, so the size of the still-exposed pool, and how quickly users migrate to fresh seeds, will determine whether this is a closing incident or a widening one.

Independent review of the Anthropic incidents. Irregular's investigation, which Irregular has confirmed is ongoing, and a third-party review Anthropic says it is arranging with METR are the checks on the claims that currently rest on Anthropic's own account, particularly the completeness of impact. The affected organisations' own findings remain outstanding.

The Keystone integration. zkX says Keystone 3 Pro support is now deployed through its mobile web app. The remaining verification points are confirmation of any corresponding Keystone firmware or website release, independent review of zkX itself, and testing of the combined implementation against the specific failure class exposed by Coldcard.

Corrections and Continuing Investigations

Ostium (correction). The correction review carried in the prior edition can now be closed. Ostium's own post-mortem has confirmed a final figure of 23,752,746 USDC, about $23.75 million, drained from its liquidity-provider vault in the 15 July oracle-signer compromise. That reconciles the earlier spread of estimates, which ran from an initial single-transaction figure near $11.86 million through interim assessments of roughly $18 million and $22 million as tracing continued. This report treats $23.75 million, the protocol's confirmed accounting, as the correct figure. The stolen funds, converted to ether and routed through a mixing service, have not been recovered.

AFX. The white-hat settlement offer noted previously remains an offer, and AFX has said it will publish a goodwill plan for affected parties on 3 August. No binding compensation terms, funding source or repayment mechanism have been confirmed, and no independently verified on-chain repayment has occurred.

Continuing investigations. The Wanchain NIGHT-bridge exploit carried previously now has a confirmed mechanism: BlockSec traced the loss of roughly 515 million NIGHT to a non-injective signed-message encoding in the bridge's TreasuryCheck validator, which let a single valid signature authorise a withdrawal many times larger than approved. Reported valuations of the drained tokens vary between about $9 million and $13 million as the token price moved, so no single figure is treated as settled here. Lien Finance, held from the same prior edition, remains under review; its OTC-pool manipulation has not been resolved to a confirmed first-party account and is not advanced here.

Published by the Zero Trust Network. Research supported by CipherBot and CipherIndex.