Post

Coldcard's third wave warrants a fatter risk discount on single-vendor self-custody. Galaxy Research's rounded estimate has reached 1,367 BTC from 4,585 addresses across three waves... wave three took about 208 BTC from 1,912 addresses. An attacker can reconstruct candidate seeds offline once device and timing state are sufficiently constrained, without contacting the victim device. The same faulty RNG fed other Coldcard secrets too, so mapped wallet sweeps leave a wider potential crypto-loss tail.