{"id":11416,"date":"2026-08-03T06:33:11","date_gmt":"2026-08-03T06:33:11","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=11416"},"modified":"2026-08-03T06:33:11","modified_gmt":"2026-08-03T06:33:11","slug":"bitcoin-plebs-rush-to-move-funds-as-suspected-coldcard-hack-sparks-self-custody-fears","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=11416","title":{"rendered":"Bitcoin &#8216;Plebs&#8217; Rush to Move Funds as Suspected Coldcard Hack Sparks Self-Custody Fears"},"content":{"rendered":"<p><\/p>\n<div>\n<div id=\"blockquote-block_4c0f5b73425557382e4cd60e5301a35c\" class=\"blockquote-container\" style=\"border-color: #5100fc\">\n<div class=\"blockquote-text\">\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Coinkite published a security advisory and shipped emergency firmware on 31 July after a defect left Coldcard seeds with as little as 40 bits of entropy instead of the expected 128.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Galaxy Research says about 1,367 BTC, roughly US$88.6 million, has been drained from 4,585 addresses, starting with 1,196 addresses emptied in 41 minutes on 30 July.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Bitcoin transfers under 1 BTC reached 39,600 BTC on Friday, the highest daily total since November 2022, according to CryptoQuant.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<p class=\"wp-block-paragraph\">CryptoQuant head of research Julio Moreno said 39,600 BTC changed hands in transfers under 1 BTC on Friday, the most in a day since 16 November 2022. \u201cThe Bitcoin plebs had not moved this amount of BTC in a day since the FTX collapse.\u201d<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-x wp-block-embed-x\"\/>\n<p class=\"wp-block-paragraph\">Moreover, Coinkite acknowledged a flaw in how its Coldcard hardware wallets generated Bitcoin seeds and shipped emergency firmware for every affected model on 31 July, after researchers began mapping a series of thefts from Coldcard-generated addresses.<\/p>\n<p class=\"wp-block-paragraph\">A firmware change made in March 2021 routed seed generation to a software fallback instead of the device\u2019s hardware random number generator, Coinkite said in a technical post.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">Seeds made on Mk2 and Mk3 devices without dice rolls ended up with roughly 40 bits of randomness, and those on the Mk4, Mk5 and Q with about 72 bits, against the 128 bits the devices were meant to produce.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">That is few enough for keys to be guessed by brute force. The fallback code had sat in upstream software since May 2018. Security researchers at Block traced the fault to a production build setting.<\/p>\n<p class=\"wp-block-paragraph\"><strong>Read more: Brother of Olympian Raygun Jailed Over $180,000 Linked to Alleged Crypto Scam\u00a0<\/strong><\/p>\n<h2 id=\"h-what-does-coinkite-say\" class=\"wp-block-heading\">What Does Coinkite Say?<\/h2>\n<p class=\"wp-block-paragraph\">The advisory covers Mk2 and Mk3 firmware 4.0.1 through 4.1.9, Mk4 and Mk5 versions before 5.6.0, and the Q before 1.5.0Q. \u201cDo not generate a new seed on any of these models until the update is installed,\u201d it says. Updating does not repair a seed already created on the affected firmware, so owners have to generate a new one and move their coins.<\/p>\n<p class=\"wp-block-paragraph\">According to Coinkite, two things can spare a wallet: feeding in at least 50 fair dice rolls during setup, or using a strong, unique BIP-39 passphrase.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">Galaxy Research put the running tally at about 1,367 BTC, roughly US$88.6 million (AU$125.8 million), across 4,585 addresses, after 1,082 BTC left 1,196 addresses in a 41-minute sweep on 30 July.\u00a0<\/p>\n<p class=\"wp-block-paragraph\"><strong>Read more: Nansen CEO Bets AI Trading Agents Will Outnumber Human Traders Within Two Years<\/strong><\/p>\n<\/p><\/div>\n<p>Bitcoin,Hackers#Bitcoin #Plebs #Rush #Move #Funds #Suspected #Coldcard #Hack #Sparks #SelfCustody #Fears1785738791<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Coinkite published a security advisory and shipped emergency firmware on 31 July after a defect left Coldcard seeds with as little as 40 bits of entropy instead of the expected 128. Galaxy Research says about 1,367 BTC, roughly US$88.6 million, has been drained from 4,585 addresses, starting with 1,196 addresses emptied in 41 minutes on<\/p>\n","protected":false},"author":1,"featured_media":11417,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[91,5845,1679,1238,652,302,5958,2139,1727,2138,3755],"class_list":["post-11416","post","type-post","status-publish","format-standard","has-post-thumbnail","category-bitcoin","tag-bitcoin","tag-coldcard","tag-fears","tag-funds","tag-hack","tag-move","tag-plebs","tag-rush","tag-selfcustody","tag-sparks","tag-suspected"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v26.6) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Bitcoin &#039;Plebs&#039; Rush to Move Funds as Suspected Coldcard Hack Sparks Self-Custody Fears - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=11416\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Bitcoin &#039;Plebs&#039; Rush to Move Funds as Suspected Coldcard Hack Sparks Self-Custody Fears\" \/>\n<meta property=\"og:description\" content=\"Coinkite published a security advisory and shipped emergency firmware on 31 July after a defect left Coldcard seeds with as little as 40 bits of entropy instead of the expected 128. Galaxy Research says about 1,367 BTC, roughly US$88.6 million, has been drained from 4,585 addresses, starting with 1,196 addresses emptied in 41 minutes on\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=11416\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-03T06:33:11+00:00\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11416\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=11416\",\"name\":\"Bitcoin 'Plebs' Rush to Move Funds as Suspected Coldcard Hack Sparks Self-Custody Fears - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11416#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11416#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/bc-plebs.jpg\",\"datePublished\":\"2026-08-03T06:33:11+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11416#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=11416\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11416#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/bc-plebs.jpg\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/bc-plebs.jpg\",\"width\":1920,\"height\":1080},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11416#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Bitcoin &#8216;Plebs&#8217; Rush to Move Funds as Suspected Coldcard Hack Sparks Self-Custody Fears\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto &amp; Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Bitcoin 'Plebs' Rush to Move Funds as Suspected Coldcard Hack Sparks Self-Custody Fears - Crypto News: Latest Cryptocurrency News and Analysis","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=11416","og_locale":"en_US","og_type":"article","og_title":"Bitcoin 'Plebs' Rush to Move Funds as Suspected Coldcard Hack Sparks Self-Custody Fears","og_description":"Coinkite published a security advisory and shipped emergency firmware on 31 July after a defect left Coldcard seeds with as little as 40 bits of entropy instead of the expected 128. Galaxy Research says about 1,367 BTC, roughly US$88.6 million, has been drained from 4,585 addresses, starting with 1,196 addresses emptied in 41 minutes on","og_url":"https:\/\/cryptonews.uk.com\/?p=11416","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-08-03T06:33:11+00:00","author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=11416","url":"https:\/\/cryptonews.uk.com\/?p=11416","name":"Bitcoin 'Plebs' Rush to Move Funds as Suspected Coldcard Hack Sparks Self-Custody Fears - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=11416#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=11416#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/bc-plebs.jpg","datePublished":"2026-08-03T06:33:11+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=11416#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=11416"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=11416#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/bc-plebs.jpg","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/bc-plebs.jpg","width":1920,"height":1080},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=11416#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"Bitcoin &#8216;Plebs&#8217; Rush to Move Funds as Suspected Coldcard Hack Sparks Self-Custody Fears"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto &amp; Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/11416","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=11416"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/11416\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/11417"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11416"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11416"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11416"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}