TUESDAY, AUG04
1. the fourth sweep wave, 2. a fix that bricks, 3. fee-mogging an attacker, 4. a Texas sized battery bet, 5. entropy school in London, 6. how the audits missed it
From Proto and Bitkey - part of the Bitcoin ecosystem at Block, Inc.
1. sweep
A fourth wave of sweeps against bitcoin held in Coldcard-generated addresses is underway, pushing estimated losses to roughly 1,816 BTC — near $114 million — across more than 5,200 addresses, according to Shaurya Malwa in CoinDesk. Alex Thorn, head of firmwide research at Galaxy Research, flagged the active wave and noted the attacker opted into replace-by-fee, meaning, as the piece puts it, “anyone who spots their address in the mempool has minutes to pay a higher fee and move funds first.” The pattern covered blocks 960,778 to 960,792, with 218 transactions hitting 462 victim addresses — about 14 sweeps per block against a 0.3 pre-incident baseline. Unlike earlier waves, destinations are fresh addresses with no prior history, one per victim, making clustering harder for forensics teams. Thorn published on pattern matching alone, choosing speed over confirmation to warn holders while transactions sat unconfirmed. For a bitcoin audience, the actionable detail is the escape hatch — until a sweep confirms, a victim can outbid it, so watching the mempool is now part of incident response.2. fault
An independent review of Coldcard’s emergency firmware argues the entropy fix is correct but ships a failure mode of its own, according to a post on X from Arkfile summarizing a pull request by developer Silexperience. The patch resolves rng_get() to the board’s true hardware randomness accessor instead of MicroPython’s software fallback — the exact substitution at the heart of the original flaw. The trouble sits in rng_get_or_fault(), which has no recovery path for the STM32’s RNG error flags, so “a single seed error latches the peripheral into a state the code can never clear.” Every subsequent call then times out and raises OSError, and because rng_get() now sits on the keypad scan path, running from an interrupt callback before login, the exception is not survivable — the device effectively bricks itself. For a freedom-tech audience, this is what post-incident review should look like: the community is auditing the fix with an intensity the original code never received, and finding that failing closed still requires a way back open.3. bait
A Coldcard owner has turned the tables on the sweeping attacker, reclaiming bait funds through a replace-by-fee counterattack, according to Will Owens in his post on X. Owens migrated his bitcoin off a compromised device shortly after disclosure but deliberately left roughly 0.0025 BTC behind as bait. The attacker eventually came for it and cheaped out on fees — “their transaction sat unconfirmed in the mempool long enough for me to broadcast an RBF replacement,” Owens wrote, routing the coins to a clean wallet instead and marveling that someone could compromise a hardware wallet and still fumble the bag. The stunt is live confirmation of the defense researchers had described only in theory: until a sweep confirms, the rightful owner can outbid it, and Galaxy Research flagged the same replace-by-fee opening across the fourth wave of sweeps. For a bitcoin audience, the lesson generalizes — fee selection is now operational security on both sides of a key compromise, and the mempool is the last venue where a victim can still win.4. battery
Base Power has launched Base Core, a roughly 40 kWh home battery designed and built in Texas, alongside a $1 billion Series D that values the company at $13 billion, according to co-founder Zach Dell’s post on X. Core is about three times the size of most home batteries, backing up an average home for as long as 36 hours, and carries a generator port so owners can recharge it through multi-day outages. The company scaled from one install per day to one hundred in two years, and the round was co-led by Ribbit, Addition, Valor and JPMorgan, with a16z, Thrive, Lightspeed and CapitalG re-investing. “Electricity is the largest and most essential industry in the world, and it does not have a defining technology company,” Dell wrote. For a freedom-tech audience, distributed batteries are energy self-custody in miniature — households holding their own reserve rather than trusting the grid alone, the same flexibility bitcoin miners already sell back to strained networks, and a hedge that matters more as AI demand tightens supply.5. workshop
OrangeSurf and collaborators are turning the Coldcard incident into hands-on education, adding an entropy session to a free builder event hosted by Antidote in Farringdon, London, according to his post on X. The update promises “a workshop to help you understand entropy, threat modeling your wallet setup and what to consider when migrating a wallet” — precisely the triage skills thousands of holders discovered they lacked when the sweeps began. The gathering brings bitcoin developers, builders and curious hackers together for a day of workshops and collaboration, registration is required but attendance is free, and OrangeSurf is offering direct help over DM for anyone whose situation cannot wait for the event. It extends his running public work on the incident, from analysis of whitehat sweep ethics to review of the replacement firmware. For a freedom-tech audience, this is the immune response working as intended — a vendor failure metabolized into open, peer-to-peer training on randomness, threat models and wallet migration rather than a lesson filtered through any official channel.6. missed
Casa co-founder Jameson Lopp answered the question hanging over the Coldcard incident — how did external audits miss the deterministic RNG bug — with four points, according to his post on X. First, the defect was non-obvious and lived in the build system rather than the main application path. Second, he believes Ledger Donjon reviewed Coldcard multiple times over the years and still missed it. Third, most large language models miss the same class of bug when they do not pull full submodule context. Fourth, critical vulnerabilities have sat undetected for a decade-plus in extremely popular codebases including SSL, SSH, and Linux. The post was a direct reply to calle’s observation that the bug sits in arguably the most important line of firmware and that real external researchers had audited the product. For operators evaluating hardware wallets after this week, the durable lesson is not that audits are worthless; it is that an audit scoped to application code, or an AI review scoped to a partial checkout, can still green-light a broken random number generator if the failure lives one layer below the files under review.Thanks for reading Tangents Daily, the front row for frontier tech. Please share & subscribe:
You have been on fire lately!