The Coldcard exploit drained over $100M from wallets that never touched the internet. How a 2021 firmware bug collapsed seed entropy, what to do with your Bitcoin now, and the AI arms race finding holes faster than teams can patch. Plus: Strategy sold again, Storj went bankrupt, and .bitcoin could become a real domain.

In this episode of Good For Bitcoin, Brandon and Kate discuss:

• The Coldcard exploit, explained: a 2021 firmware bug silently swapped seed generation to a weak software RNG seeded by the device ID and the clock, cutting entropy from 128 bits to about 40. Over $100M is tracked stolen on-chain. Dice rolls helped. Stop using Coldcard.
• What now? Brandon's 3-2-1 rule: three wallets, mixed hardware and software, one offsite. Multisig via Bitkey, Casa, or Unchained. Prefer custody? River, Fidelity, BitGo, or AnchorWatch, offering 60 days of free custody as a Coldcard safe haven.
• The AI security arms race: Boltz suspended swaps citing AI-assisted probing, Zeus shut down over a security incident, and BTCPay Server disclosed a critical vulnerability under active exploitation. The red team started by Rob Hamilton and led by calle has scanned 425 projects and filed 1,000+ high or critical findings. OpenSats reimburses the researchers.
• Treasury tracker: Strategy sold 1,637 BTC (~$104M) and bought back $81M of STRC (842,138 BTC held, STRC at $95). Strive +20 (20,020), Block +85 (9,117), American Bitcoin +298 (8,300), OranjeBTC +30 (3,948), Capital B +1 (3,140), Smarter Web +12 (2,712). Cipher Digital sold 470 (646 left); Sequans sold 344 (314 left).
• A French tax agent allegedly sold crypto holders' data from government databases to criminals, linked to a violent home invasion. Kate on the KYC honeypot, and why an offsite multisig key defeats the wrench attack.
• Mempool explorer founder Wiz is filing for the .bitcoin TLD in ICANN's first new gTLD window since 2012. Without a community application it goes to auction; he needs written support from Bitcoin projects.
• Stacks users: POX unstacked every STX position. Restake by around August 12 or miss a cycle of Bitcoin rewards. Leather pools, Xverse, StackingDAO, or the Ryder One all work.
• Also: Storj filed Chapter 11, BitMart is winding down, POAP is shutting down, Fold Bitcoin gift cards hit TikTok at a discount, a solo miner won 3.157 BTC (~$200K), and the Senate punted the Clarity Act to September. Bitcoin already has clarity.
• Follow the show on X: @goodforbtc.

Hosts:

• Brandon Marshall — @marshallmixing
• Kate Parkman — @katemparkman

Subscribe & Follow:

• goodforbitcoin.com
• YouTube
• Spotify
• Amazon Music
• Apple Podcasts
• Pocket Casts
• RSS