As if last year hasn't been hard enough

on the hodlers, last week what used to

be the safest way to store Bitcoin

turned out to be the fastest way to lose

it when Coldcard, a security-obsessed

air-gapped Bitcoin hardware wallet, was

hacked. The bad news is that a lot of

people lost a lot of money, but the good

news is that it's only about half as

much as they would have lost if the same

thing happened a year ago. Since July

30th, attackers have drained over 1,600

Bitcoin, worth about $100 million,

from over 7,000 wallets. And the

craziest part is that they pulled it off

without any malware, phishing, or lead

pipes. The victims weren't your typical

degenerates clicking random Discord

links, either. They were the responsible

ones with the not your keys, not your

crypto tattoos lecturing you about how

you don't actually deserve freedom if

your coins were on an exchange. In

today's video, we'll dive into how the

hack works and learn why victims are now

bidding against the hackers in real time

to try to buy back their own money. It

is August 5th, 2026, and you're watching

The Code Report. If you've never seen

your net worth drop 60% in a day, you

may not know that the way Bitcoin works

is that your coins are controlled by a

private key, which comes from a 12-word

seed phrase. If you have those words,

you have the Bitcoin. And since the

entire security model depends on those

words being unguessable, they're chosen

by your wallet using a random number

generator. A properly generated seed

phrase has 128 bits of entropy, which

means if you try a billion guesses per

second, the universe would end before

you got close. And this principle is

exactly why hardware wallets exist in

the first place, to generate keys on a

dedicated offline device with a special

chip whose entire job is to harvest

genuine randomness from the physical

universe. And no device took this more

seriously than Coldcard, made by

Canadian company Coinkite. It's

air-gapped, open source, and marketed to

people who are worried the government is

going to make you get a license to make

toast in your own damn toaster. But it

doesn't matter how sophisticated your

random number generator is if you never

actually use it. And for the last 5

years, without them knowing, the

Coldcard never did. Here's how it

happened. The Coldcard's firmware runs

on MicroPython, which ships its own

basic random number generator, which was

built for simple jobs, but it's nowhere

strong enough for generating keys. The

Coinkite knew this, so they wrote their

own generator, and by setting a specific

flag to zero, they disabled

MicroPython's generator, or at least

that's what they thought. But here's

where things went wrong. Both number

generators exposed a function with the

exact same name, and the crypto library

would decide which one to use based on

an if not defined check. And because the

flag was technically defined just as a

zero, the check passed, and every seed

phrase was generated by the basic

MicroPython number generator, not

Coldcard's sophisticated generator. But

it turns out, because a bare metal chip

has no operating system, there's nowhere

for MicroPython's number generator to

get real randomness from. And so

instead, it fakes it using the chip's

serial number and a timer, both of which

are deterministic. So instead of

guessing a seed phrase out of every atom

in the universe, you could just loop

through all possible combinations of

serial numbers and timer values, and

come away with everyone's keys. And on

July 30th, that's exactly what the

attacker did. In under an hour, the

first attacker drained over 1,000

Bitcoin from nearly 1,200 addresses,

hitting the biggest wallets first. Then

two more attacks happened over the

weekend, which pushed the total to

nearly 1,800 Bitcoin from over 7,000

addresses. The Coinkite CEO apologized

and took full accountability, but by the

nature of the attack, they couldn't just

issue a firmware update to solve the

problem. Because Bitcoin has no way to

rotate a key, the only way out is for

victims to generate a brand new seed and

move their coins with an actual on-chain

transaction. But of course, because this

is Bitcoin, every transaction waits in

the public mempool until a miner

includes it in a block, which means the

attacker can just watch the mempool for

anything coming from a compromised

address. They can then sign their own

competing transaction with the same keys

and a higher fee, and miners will

confirm the highest bidder first. So

when a fourth attack went live on Monday

morning, the only way to win was to skip

the public mempool entirely and send

your rescue transaction directly to a

mining pool since the bot can't outbid a

transaction it never sees. So, yeah, the

official rescue plan for your trustless

decentralized money was to put all your

trust in one centralized miner and hope

for the best. As for Coldcard, every

unsold device in their warehouse carried

the same broken firmware and so they had

to hold shipments and take the remaining

inventory out to the pasture. But, all

of this could have been avoided had they

just built their product with Lovable,

the sponsor of today's video. Lately,

I've been wanting to make the world a

better place, so I use Lovable's AI

development platform to build my own

predictions market, which lets you

gamble away your life savings on things

like future video topics or how many

scam Altman jokes I'll make this month.

I started with plan mode where Lovable

mapped out the flow and let me edit the

plan before writing any code. Then, it

built the whole thing including auth,

payments, and a managed Postgres

database on Lovable Cloud. It did get

stuck in a loop on a database policy

bug, but then I moved back into plan

mode and Lovable was able to fix it on

its own. Then, I gave the app its own

MCP server so that right here in Cload

Code, I can pull live odds or hold

trading whenever I'm losing a bet to

make sure the house always wins. Over 50

million projects have already been built

with Lovable and you can try it out for

free today with the link below. This has

been The Code Report. Thanks for

watching and I will see you in the next

one.