Today’s Field Note

The Coldcard entropy flaw is the real story, not the custody-debate noise around it. Weak entropy in seed generation means affected units may have produced predictable keys, and about $120M has already moved as holders scramble, with Bitcoin seven-day active supply hitting a 2026 high (roughly 890,000 BTC in motion per K33). This is not a phishing incident you can out-discipline. If your seed was generated on a vulnerable Coldcard, the address is compromised regardless of how carefully you have behaved since. Separately, self-hosters had a bad day: Gitea CVE-2026-59774 (CVSS 9.8) lets unauthenticated attackers read any file the service account can touch in versions 1.22.1 through 1.27.0, and CISA added a Langflow RCE (CVE-2026-9198) to its exploited-in-the-wild list.

Today’s Move

  • If you hold BTC on a seed generated by an affected Coldcard, generate a fresh seed on a known-good device and move funds now, do not wait for a post-mortem.
  • Treat any funds still on a suspect seed as already lost, prioritize the largest UTXOs first given mempool congestion.
  • Patch Gitea to 1.27.1 immediately if you run 1.22.1 through 1.27.0, then rotate any secrets, tokens, or keys that lived in reachable files.
  • Pull Langflow off the public internet and patch CVE-2026-9198, assume compromise if it was exposed.
  • Ignore the recovery-service DMs and the “buy the dip” custody takes, neither addresses the key-generation problem.

Resources

  • https://www.coindesk.com/daybook-us/2026/08/05/the-usd120-million-coldcard-hack-lights-up-bitcoin-s-memory-pool
  • https://thehackernews.com/2026/08/critical-gitea-flaw-let-unauthenticated.html
  • https://thehackernews.com/2026/08/cisa-flags-langflow-rce-tomcat-and-n.html
  • Incident trackers (reference standard): Rekt leaderboard · SlowMist Hacked

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @ItsAlreadyPrice or subscribe via RSS.