A firmware flaw in Coldcard wallets shipped since March 2021 reportedly generated weak private keys with ≈72 bits of entropy instead of 128. Attackers drained over 1,000 BTC, with estimates ranging from $38M/594 BTC to about $70M per Galaxy Research, in a 25-minute window on July 30-31.
Matters because: This is a security-specific event with limited direct market-cap impact, but it could dent retail confidence in self-custody hardware and spark follow-on FUD.