The Flaw That Drained $38M in Bitcoin in 25 Minutes | CoinDesk Daily artwork

The Flaw That Drained $38M in Bitcoin in 25 Minutes | CoinDesk Daily

CoinDesk Podcast Network

July 31, 2026

594 Bitcoin gone. A flaw in how Coldcard hardware wallets generated their keys let an attacker sweep roughly 594 bitcoin — about $38 million — from around 500 wallets in just 25 minutes. The bug traces back to a March 2021 firmware update. CoinDesk's Jennifer Sanasie hosts "CoinDesk Daily.
Speakers: Jennifer Sanasie
**Jennifer Sanasie** (0:00)
Roughly 594 Bitcoin drained in 25 minutes, and New York sues CalShe as a gambling platform. This is CoinDesk Daily.
Lower rates protected Bitcoin. Lettens lowest loan rates ever. Check yours at lettin.io. Roughly 594 Bitcoin worth about $38 million was swept out of around 500 wallets in a 25-minute window early Friday. The culprit was a flaw in how Coldcard hardware wallets generated their keys. Every drained wallet was a single signature and held more than 0.15 Bitcoin. CoinKite says the flaw traces to a March 2021 firmware update affecting the MK3. New York is suing prediction market CalShe, alleging it runs an unlicensed gambling business in the state. Attorney General Letitia James is seeking triple CalShe's gains, plus $100,000 for each unauthorized sports wager. She said no matter what they call themselves, prediction markets like CalShe are gambling platforms plain and simple. CalShe is pushing back, calling it political theater, and arguing states can't shut down a federally licensed exchange.
RealFi, a smarter stablecoin backed by real world assets. Join the testnet now at realfi.co. And JP Morgan says fading odds of the Clarity Act passing this year are a setback for crypto markets. Prediction markets now imply just a 27% chance the bill gets signed into law before year end after lawmakers prioritize other legislation ahead of the recess. Negotiations remain stuck on ethics, provisions, DeFi and stablecoin yield. Get more updates on coindesk.com.
Follow JPEG Trading on X for insights on crypto markets, liquidity and DeFi.

Feed this to your agent

Try it now — copy, paste, done:

curl -H "x-api-key: pt_demo" \
  https://spoken.md/transcripts/1000651996090

Works with Claude, ChatGPT, Cursor, and any agent that makes HTTP calls.

From $0.10 per transcript. No subscription. Credits never expire.

Using your own key:

curl -H "x-api-key: YOUR_KEY" \
  https://spoken.md/transcripts/1000779313068