Coldcard exploit triggers mempool wars across Bitcoin

A five-year-old firmware error has escalated into a full-scale automated war across the Bitcoin network. What began as a catastrophic key drain on Coldcard hardware wallets has turned into a high-stakes battle inside the mempool, where white-hat defenders and automated scripts fight over exposed unspent outputs.

The core vulnerability traces back to a March 2021 firmware commit. A preprocessor macro error in the C code caused Coldcard devices to silently bypass their hardware random number generator during key creation. Instead of failing closed, the devices defaulted to predictable software fallbacks with as little as 32 bits of entropy, leaving seeds vulnerable to basic laptop brute-forcing.

Cryptographic signatures recently linked the fatal commit to the personal GPG key of Coinkite chief technology officer Peter Gray. Security researcher James O'Byrne identified 58 signed commits under a GitHub alias that pushed the broken entropy code directly to production without peer review. The discovery shattered user trust in single-vendor code reviews and hardware air-gaps.

Artificial intelligence drastically accelerated both the discovery and execution of the exploit. While malicious actors used unrestricted models to scan repositories and grind through weak key spaces, defensive researchers faced safety guardrails on domestic platforms. Galaxy Research head Alex Thorn noted that analyzing public blockchain data triggered safety downgrades on frontier models, forcing security teams to use open-source alternatives.

The machine-speed attack vectors quickly spilled beyond individual wallet balances. Machine-driven probes overwhelmed non-custodial Lightning infrastructure, forcing services like Boltz Exchange and Zeus Lightning to pause operations indefinitely. Open-source maintainers acknowledged that small developer teams could no longer patch newly uncovered vulnerabilities as fast as automated AI agents identified them.

For compromised holders, broadcasting standard recovery transactions became a hazard. Attackers monitoring the public mempool used Replace-By-Fee bidding wars to front-run transfer attempts and divert funds in real time. Simultaneously, the exposed key space retroactively de-anonymized historical CoinJoin rounds, shrinking the anonymity set for innocent participants who mixed coins alongside flawed Coldcard seeds.

To survive the mempool predator zone, distressed holders turned to private transaction relays. Mempool researcher Orange Surf tracked over 5,600 Bitcoin routed through Marathon's Slipstream service since the exploit surfaced. By submitting signed transactions directly to miners rather than broadcasting them publicly, multisig signers prevented front-running scripts from intercepting their remaining funds.

The fallout has permanently altered hardware custody standards across the industry. Prominent ecosystem figures like Marty Bent and Matt Odell have abandoned single-vendor recommendations, urging holders toward multi-signature quorums with distinct hardware vendors. Trust in single-device sovereignty is broken, replaced by an era where every line of open-source firmware must assume perpetual machine attack.