Coldcard drain hits ~1,816 BTC ($114M) across 5,200+ addresses — and the tally is still rising
The Mk3 firmware bug (from 4.0.1, March 2021) silently fell back to a weak PRNG — ~40 bits of entropy instead of 128 — letting attackers reconstruct seeds offline; researchers now count ~$114M removed since July 30, up from the initial $70M estimate.
"Cold storage" is only as good as its entropy — and drain totals compound for days after disclosure. Verify seed provenance, not just device brand, on every KWIZERANA self-custody setup.
Adform ad-network JavaScript compromised Aug 1 — rewrites wallet addresses on legitimate sites
Attackers modified a JS file served by advertising company Adform, turning it into a clipboard/address-swapping tool that hijacks crypto transactions on any page loading the tainted script.
You can be drained by a trusted news site's ad stack — verify the address on your signing device for every transfer, no exceptions.
Injective Labs SDK GitHub repo hijacked; malicious npm package steals wallet private keys
The compromised version shipped July 8 and propagated through dependency trees for weeks before detection — any project that pulled the poisoned package should rotate keys and rebuild from clean lockfiles.
Supply-chain compromise is now the dominant non-DPRK vector — KWIZERANA bots should pin dependencies and audit lockfiles before any deploy.