Coldcard Bug Drains $111M in 1,719 BTC Heist

Coldcard firmware bug drained 1,719+ BTC (~$111M) across 5,200+ addresses in 3-4 waves starting July 30, 2026. Mk2/Mk3 (firmware 4.0.1-4.1.9) had ~40-bit entropy; Mk4/Mk5/Q ~72 bits. Coinkite shipped patches July 31. Attackers brute-forced seeds offline—no device compromise.