On July 30, 2026, an attacker started emptying Bitcoin wallets that people had bought specifically so this could not happen. By the time the draining slowed down, more than 1,800 BTC, worth somewhere between $116 million and $130 million depending on who was counting that week, had moved out of over 5,200 addresses. No phishing link. No stolen laptop. No exchange going under. The devices never touched the internet, and the coins left anyway.
The device was a Coldcard, made by the Canadian company Coinkite, and among people who take self-custody seriously, it is close to the gold standard. Air-gapped, open source, built for exactly one job: keep your Bitcoin keys away from anything that could reach them remotely. The pitch has always been simple. If your key never touches the internet, nobody can take your coins without physically holding the device in their hands.
That pitch turned out to have a hole in it, and the hole had been sitting there since March 2021.
A Build Flag From 2021
The bug traces back to a firmware migration that quietly rerouted how Coldcard generated wallet seeds. Instead of pulling randomness from the device’s dedicated hardware random number generator, the code fell through to a software fallback. The seeds were supposed to carry 128 bits of entropy. On the affected models, they carried something closer to 40.
Forty bits is not an abstract weakness. It’s a search space you can actually run through with off-the-shelf computing power, and that’s exactly what happened. Attackers generated candidate seeds, derived the addresses those seeds would produce, and checked each one against the public blockchain. One sweep alone pulled roughly $70 million out of 1,196 addresses in about 41 minutes, according to reporting from The Hacker News. Losses kept climbing through August as more waves hit, with Galaxy Research settling on a figure near $112 to $115 million by mid-August and TRM Labs putting the total closer to $116 million across more than 5,200 addresses.
One Coldcard user, Jonathan Goodman, lost roughly $1.6 million and put it to TechCrunch about as plainly as it can be put: he did everything right, his device never touched the internet, and he still lost the money because of one line of code from 2021. That’s the whole story in one sentence, honestly.
Here’s what’s worth sitting with for a second. Nobody broke SHA-256. Nobody solved elliptic curve cryptography. The math that supposedly makes Bitcoin bulletproof held up completely fine through all of this. It just never got the chance to matter, because a build configuration error routed key generation around it entirely.
This is closer to how cryptographic systems usually fail in the real world. DES fell. MD5 fell. SHA-1 fell. None of those died because someone counted through the keyspace with a faster computer. They died because an implementation somewhere didn’t deliver what the specification promised. Your private key isn’t math floating in the abstract. It’s a number that a piece of code produced on a specific day, written by a person who set one flag wrong and didn’t catch it, and neither did anyone else, for five years.
The Ledger Was Never Actually Private
There’s a second assumption worth pulling apart, and it has nothing to do with firmware. A lot of Bitcoin holders talk about the network as something that sits outside government reach. It doesn’t, and hasn’t for years.
Bitcoin is pseudonymous. That’s a very different thing from anonymous. Every transaction ever made is published permanently, visible to anyone who wants to look, and it stays that way forever, waiting for the day someone connects a wallet address to a real name. A bank record stays private until someone gets a subpoena for it. A Bitcoin transaction is public from the second it confirms, and there’s no unwinding that.
There’s a whole industry built around closing that last gap between address and identity. Chainalysis alone has taken in $68.6 million in contracts from eight U.S. federal agencies since 2019, with roughly half of that coming from the IRS, including a $21.5 million subscription deal signed in September 2023. A separate $1.25 million contract went specifically toward tracking Monero and the Lightning Network. The government isn’t paying for the ability to read the chain. That part is free, and any node operator can do it. What they’re buying is the identity layer sitting on top of it.
And seizure isn’t some hypothetical either. The U.S. government currently holds roughly 328,372 BTC, worth north of $20 billion, inside a Strategic Bitcoin Reserve created by executive order in March 2025. About 127,000 of those coins came out of the Prince Group case, roughly 94,600 from the Bitfinex hack recovery, and about 94,700 from Silk Road seizures. The state is now one of the largest Bitcoin holders on earth, and it paid for exactly none of it.
So the real question isn’t whether anyone’s watching the chain. Obviously they are, and it’s a budgeted line item, not a conspiracy theory. The more interesting question is why a government would want the ability to decide which transactions get to confirm in the first place. That’s a different kind of power than just reading a public ledger, and it’s the kind that hash rate concentration could eventually hand someone.
The Quantum Number Just Got Smaller Again
This is where the conversation usually splits into two camps that are both a little wrong. One side says a 256-bit key is mathematically unbreakable and the topic is closed. The other says quantum computers show up next year and take everything. Neither is right, and the actual situation is stranger than either version.
Brute force really is off the table. Counting through the keyspace one guess at a time is a thermodynamics problem, not an engineering one, and no chip roadmap changes that. But brute force was never the threat. Shor’s algorithm doesn’t guess. It runs the elliptic curve signature backward through a completely different mathematical route, turning a public key straight into the private key that produced it.
On March 30, 2026, Google Quantum AI published a whitepaper with researchers from the Ethereum Foundation and Stanford University laying out exactly how to do that to Bitcoin’s curve. Their number: as few as 1,200 logical qubits and under 90 million Toffoli gates, translating to fewer than 500,000 physical qubits on a superconducting architecture. That’s roughly a 10x reduction in spacetime volume compared to the best prior single-instance estimate, and close to 20 times smaller than Google’s own 2019 figure of 20 million qubits.
Nobody built a bigger machine to get there. Somebody found a better algorithm.
That distinction matters more than the headline number does. The elliptic curve discrete logarithm problem has never actually been proven hard. It’s a conjecture that’s held up for forty years because a lot of smart people have failed to break it, which is strong evidence but isn’t the same thing as proof. If someone finds a classical shortcut tomorrow, there’s no countdown, no migration window, no press release. It just happens, possibly to someone who has every reason to keep it quiet for as long as they can.
To be fair, the actual hardware to run this attack doesn’t exist yet, and Fireblocks’ own writeup on the paper is careful to note that current quantum processors sit in the hundreds to low thousands of physical qubits with error rates nowhere near good enough for sustained fault-tolerant computation. That gap is still measured in years. But the goalposts keep moving in one direction, and they’ve moved twice in six months on paper alone, without a single new qubit being manufactured.
A Plan to Freeze a Third of Everything
Bitcoin’s developers aren’t ignoring any of this, which is arguably the most interesting part of the whole year and the part getting the least attention relative to how much it actually matters.
On February 11, BIP-360 merged into the Bitcoin repository, introducing a new quantum-resistant address type called Pay-to-Merkle-Root. Nobody’s fighting about that part; it’s just a new place to put coins that isn’t vulnerable to Shor’s algorithm the way exposed public keys are.
The fight is over BIP-361. Jameson Lopp, Casa’s chief technology officer, published the draft on April 14 along with five co-authors, titled “Post Quantum Migration and Legacy Signature Sunset.” It runs in phases. Roughly three years after activation, the network stops allowing new sends to legacy address types. Roughly five years after activation, old-style ECDSA and Schnorr signatures stop validating entirely. Anything still sitting in a vulnerable address at that point becomes permanently unspendable.
The scope here is not small. Estimates put somewhere between 6.5 and 6.9 million BTC as exposed under the proposal’s definition, close to a third of everything that will ever exist, including an estimated 5.6 million coins that haven’t moved in over a decade, and something like 1 to 1.7 million BTC tied to addresses attributed to Satoshi Nakamoto, worth roughly $74 billion at the time BIP-361 was published.
Adam Back has pushed back hard on this, arguing for optional, opt-in upgrades instead and calling today’s quantum hardware lab experiments dressed up as an emergency. He’s been following this field for twenty-five years and calls the recent progress incremental rather than alarming. He might turn out to be completely right about the timeline. Honestly, nobody knows yet.
But look closely at what the actual disagreement is about. One side wants to invalidate dormant coins on a fixed schedule. The other wants to wait and coordinate a response if and when the threat becomes concrete. Neither side is arguing that your coins can’t be taken from you by a decision made somewhere other than your own wallet. They’re arguing about who gets to make that call, and on what timeline.
“Not your keys, not your coins” was always framed as a warning about custodians. The deeper version nobody says out loud as often: even holding your own keys doesn’t settle the question, because the rules that determine what a key is even allowed to spend are a social agreement among developers who can, in principle, vote to change them. Property that a mailing list can freeze by rough consensus isn’t quite the same thing as property nobody can touch.
Where the Money Actually Went
The last piece of this is what self-custody holders did in the days right after the Coldcard hack became public, and it’s the part that undercuts the whole thesis most directly.
They moved into the exact system self-custody exists to avoid.
In the week following the disclosure, U.S. spot Bitcoin ETFs pulled in roughly $853 million, their strongest week since April, according to Bloomberg and multiple outlets tracking SoSoValue data. BlackRock’s IBIT alone captured about $694 million of that, more than 80% of the total flow into Bitcoin funds that week. Eric Balchunas, Bloomberg Intelligence’s senior ETF analyst, called it hard not to see causation in the correlation, given that IBIT, FBTC, and several smaller funds posted inflows every single trading day since the hack. He was also careful to add that he wasn’t certain, saying, “I’m not saying it’s connected, we just don’t know,” which is a more honest position than most people took on either side of the argument that week.
Roughly 890,000 BTC moved on-chain during that same stretch, the highest weekly figure recorded in 2026, with a chunk of it landing on centralized exchanges rather than staying in private wallets.
An ETF share is about as far from self-custody as Bitcoin exposure gets. It’s fully identified, fully reportable, and freezable by court order the way any other regulated security is. The coins sit with an institutional custodian, not with the person who bought the shares. It is, by a wide margin, the most surveilled and most seizable way to hold Bitcoin exposure that exists today. And in the same week that self-custody’s best real-world argument collapsed on a five-year-old build flag, that’s precisely where a meaningful chunk of the marginal dollar went.
What This Actually Means If You Hold Bitcoin
Nobody’s saying sell your Bitcoin here. What’s actually true is that several of the standard reasons people give for owning it directly have taken real damage over the past six months, while most of the public conversation stayed fixed on price and nothing else.
What’s sitting in front of holders right now is a set of risks that don’t show up on a candlestick chart. There’s implementation risk, which the Coldcard episode priced at somewhere north of $116 million in a single stretch, and which applies to every wallet, every signing library, and every exchange in the stack, not just one manufacturer’s firmware. There’s surveillance risk, which isn’t some future concern; it’s a line item in federal budgets today, running into the tens of millions of dollars. There’s governance risk, in the form of a live, seriously debated proposal to render a third of the total supply unspendable on a fixed schedule. And there’s a cryptographic timeline that’s compressed twice this year on paper alone, with zero new hardware built.
None of that gets priced by markets the way a bad earnings report does, mostly because it isn’t the kind of risk that shows up gradually. It tends to show up all at once, on a random Thursday, the way this one did.
If you want Bitcoin exposure anyway, the more useful question isn’t whether you can avoid risk entirely. You can’t, not in any version of this. It’s which failure mode you’re choosing. Self-custody hands you implementation risk and puts you in charge of auditing firmware you almost certainly can’t actually audit yourself. ETFs and other custodians hand you full identification and a counterparty you have to trust instead. The equity route (miners, exchanges, MicroStrategy’s balance sheet and its imitators) wraps Bitcoin’s volatility inside management decisions and, often, borrowed money, which is usually a bigger risk than the coin itself, not a smaller one.
There isn’t a version of this where you’re standing entirely outside the system. There hasn’t been one for a while now, and the events of the last six months made that harder to ignore than it’s ever been.
Three Things Worth Watching From Here
Whether BIP-361 picks up real support among miners and node operators through the rest of the year matters more than most price action, because a credible activation path would force markets to finally price in a supply event that basically nobody currently has in a model. Whether more wallet and signing-library vulnerabilities surface now that researchers know entropy failures are a productive place to dig is worth tracking too, since a five-year-old bug sitting undiscovered inside a well-regarded, audited device is not exactly a reason for confidence that it was the only one. And the quantum resource estimates deserve more attention than the raw qubit counts get in headlines, because the number that actually moved twentyfold this year moved on an algorithm, not on new hardware, and whatever reduction comes next will very likely arrive the same way, without much warning at all.
The math behind Bitcoin has never been the part anyone should worry about. Everything wrapped around that math, the firmware, the surveillance contracts, the developers who can vote to change what a key is allowed to do, is ordinary technology, built by ordinary people who occasionally set one flag wrong and don’t notice for five years. It fails the way all technology eventually fails, which is usually through some new idea nobody saw coming, not through anyone finally beating the math.