Coldcard: “The bug lived in public for 5yrs, even third party researchers didn't find it. We believe if took the lastest LLM models to find it.” Public record: “The flaw was pointed at, in May of 2025, by a person, with no frontier model, who traced it to the library by name and was told the company would already know if something were wrong. It was found again after disclosure by people pointing ordinary code-analysis tools at a public repository. What took five years was not the finding. It was the looking.”

Coldcard turned bitcoin:native's strongest promise into its biggest risk. @Legendaryy on self custody: “And no matter how much of a believer you are, with all of that happening, I think the best way to store your Bitcoin, unfortunately, is to go out there and buy a BlackRock ETF. Because if BlackRock is messing up their storage, then they are physically replicating the Bitcoin. They owe you the Bitcoin, simply put.”

🚨 Coldcard Bitcoin Hack Update: 1,082.65 BTC swept from ~1,196 addresses in just 41 minutes — before the vulnerability was even publicly disclosed. The attacker may have used a paid blockchain-services account, leaving an off-chain trail investigators are now chasing. Read more 👉: #KuCoin# #KuCoinSecurity#

The Coldcard incident resulted in Long-Term Holder supply declining by ~233k BTC, a 1.38% fall from its recent all-time high. With such a meaningful event, an important question is whether the emergency migration of coins has skewed the onchain metrics we use to analyse Bitcoin. In our latest newsletter piece, @_Checkmatey_ documents the size and scale of the change across network activity and onchain supply structure, and assesses how it influences several key onchain metrics →