Coldcard firmware flaw costs users millions

Every week, Amdax summarizes what’s happening in the crypto market for you. Want to dive deeper? Click on the links (if available) in this article for more insights.

Market update

Stay informed in three steps:

1. Bitcoin closes the week flat despite Strategy's policy shift
Bitcoin closed the week roughly flat, near 63,900 dollars at the start and around 64,000 dollars at the end. There was movement along the way: Strategy announced it will no longer automatically put every capital round into bitcoin, and sold 1,638 bitcoin last week at an average of 63,957 dollars per coin, the first clear signal that the company is loosening its fixed 100 percent bitcoin approach. The price briefly dipped in response, but the effect was limited and the loss was recovered within a few days. The broader altcoin market moved in the same calm pattern, with no pronounced upside or downside outliers.

2. A divided Fed holds rates, stocks rattle but crypto stays calm
Last Wednesday the Federal Reserve left rates unchanged at 3.50-3.75 percent, but the vote was strikingly split: three regional presidents dissented and pushed for a hike, the largest group of dissenting votes since 2016. Stock markets reacted sharply: the S&P 500 lost 1.5 percent and the Nasdaq 1.7 percent, while long-term Treasury yields moved higher. Crypto held up better: bitcoin remained roughly stable around 64,000 dollars while stocks slid. A day later the US PCE inflation gauge came in line with expectations, taking the pressure off: the Nasdaq recovered 2.8 percent and the S&P 500 1.7 percent, and within 24 hours most of the damage from the rate decision was undone.

3. Coldcard hardware wallet firmware bug costs users 130 million dollars
Price aside, it was a turbulent week for owners of the Coldcard hardware wallet. A five-year-old firmware flaw turned out to use too little randomness when generating seed phrases, letting attackers reconstruct the underlying private keys. Since July 30, hackers have exploited this in several waves, causing more than 130 million dollar in damage. Manufacturer Coinkite confirmed the flaw and urged users with vulnerable firmware to move their funds to a new wallet, since an update does not fix a seed that has already been generated. Competitors like Ledger, Trezor, and Bitkey use a different method for randomness and were not affected. In this article, we take a closer look.

Tim's take

This week highlights something that has been playing out for a while: stock markets have been moving more sharply than the crypto market over the past month. Tech stocks swing on every data point on inflation, rate policy or chip demand, while bitcoin has been stuck in a narrow band for weeks. When the Fed opted for a divided pause on Wednesday, stocks pulled back sharply while bitcoin barely budged. This is not a one-off, the pattern has been in place for several weeks now. That kind of persistent calm, after a heavy correction, does hint at signs of a bottoming process: less panic, smaller swings, and a price that seems increasingly hard to push lower. It is not certain, but it is the kind of behaviour that tends to show up towards the end of a correction rather than in the middle of one.