Why Coldcard's 5-Year-Old Bug Let Hackers Take Over $100M in Bitcoin: Uneasy Money

Summary

The episode covers the Coldcard hardware wallet entropy bug that has led to over $100 million in Bitcoin stolen across multiple attacker waves, the SK Hynix perp crash on trade.xyz caused by thin pre‑market trading and oracle issues, and a heated debate over Ethereum EIP‑8361, a proposal to slash staking issuance that guests warn could depress ETH price by forcing massive unstaking.

• A five‑year‑old randomness bug in Coldcard hardware wallets has already drained an estimated 1,600–1,800 Bitcoin from hardcore self‑custody users, with further losses expected as attackers continue to mine weak seeds.
• Contrary to speculation, the main threat actor is likely not North Korea but professional GPU crackers with years of experience breaking entropy and databases.
• The dice‑rolling ritual promoted to early Coldcard victims often provided insufficient entropy, leaving them just as vulnerable.
• An SK Hynix perpetual contract on trade.xyz crashed from $1,128 to $917 on a real pre‑market print, then recovered; trade.xyz decided to make users whole but warned it would not set a precedent.
• The incident reignited the debate on whether DeFi front‑ends have a responsibility to block user trades that are obviously irrational or loss‑making.
• A contentious Ethereum EIP‑8361 proposal would cut ETH staking issuance, sparking fears that it could cause tens of billions of dollars of ETH to be unstaked and dumped on the market.
• Guests argue that increasing issuance would be a stronger move than decreasing it, and that the safest approach is to leave ETH monetary policy unchanged.
• The debate is seen as part of a new, more fragmented governance landscape following the breakup of the Ethereum Foundation, which could lead to more public disagreement but also more discussion.