I’ve written four separate articles over the past few weeks that each felt, at the time, like their own self-contained story. A hardware wallet vulnerability. A failed soft fork. A swap provider shutting itself down over AI-assisted attacks. A historic short squeeze.
Read individually, they’re four unrelated news items from four different corners of the Bitcoin world. Read together, in sequence, over the same four-week window, they tell a much more useful story, one about where the real risk in this ecosystem currently sits, how fast that risk is evolving, and what a sovereign Bitcoin holder should actually be doing about it right now rather than after the next headline.
This piece does two things. First, it synthesizes what actually happened and why the timing matters. Second, and this is the part I think earns the paywall, it’s a concrete operational checklist, the specific things I’d actually go check on my own setup this week, in order of priority, with the reasoning for each one spelled out.
Week one: Coldcard. A firmware configuration bug on certain Coldcard Mk2 and Mk3 devices disabled the hardware random number generator, and the safety check meant to catch this only verified the setting existed, not that it was actually running. Seeds generated during the vulnerable window had entropy as low as 40-72 bits instead of the intended 128. Reported losses started at roughly $38 million from about 500 wallets. By the time I checked back a few weeks later, that figure had climbed past $111 million, and I flagged honestly that it wasn’t clear whether that increase reflected newly identified historical losses or continued active exploitation.
Week two: BIP-110. A proposal to restrict non-financial data from Bitcoin transactions used a user-activated soft fork, the same mechanism that activated SegWit in 2017, with a signaling threshold of 55%, lower than Bitcoin’s traditional 95% supermajority. Support never got close, around 0.42% of hashrate in the months before activation, roughly 2.5% when the mandatory window actually started. The resulting minority chain inherited full mainnet mining difficulty with almost none of the hashrate behind it, and was 48 blocks behind mainnet within two days, producing a new block every 6.9 hours instead of ten minutes. It was functionally dead on arrival.
Week three: Boltz. The non-custodial swap provider connecting Bitcoin’s mainchain, Lightning, and Liquid shut down all services on August 3, citing months of AI-assisted attacks against its codebase that had outpaced what its small team could patch. No funds were lost, Boltz never held custody, but three consumer wallets, ZEUS, Aqua, and Bull Bitcoin, lost swap functionality within hours with no warning.
Week four: the squeeze. Bitcoin went from the low $60,000s to $75,527 in days, the largest short liquidation event since 2021, roughly $2.75 billion in Bitcoin shorts wiped out in a single session. The trigger traced back to a Treasury bond buyback announcement and a White House meeting landing on the same day, not to anything crypto-specific.
On the surface these are four different domains, hardware security, protocol governance, software infrastructure, and market mechanics. But look at the failure mode underneath each one, and a single pattern runs through all four.
In every case, something that looked like a valid safeguard turned out to be hollow the moment it was actually tested. Coldcard’s check verified a setting existed without verifying it was active. BIP-110 copied SegWit’s activation mechanism without the underlying economic alignment that made SegWit’s version of it actually work. Boltz’s own admission was, in effect, that its normal development and patching cadence, adequate for years, was no longer adequate against attackers whose discovery speed had fundamentally changed. And the squeeze, while not a failure exactly, demonstrated the same underlying fragility from the other direction, a market heavily positioned on one assumption (continued decline) got violently unwound the moment two unrelated catalysts landed together.
And in three of the four cases, the accelerant was speed, specifically the speed at which AI tooling now lets both attackers and analysts operate. Boltz said this explicitly. The Coldcard vulnerability was reportedly first identified by a developer using an AI model to review the firmware’s public repository, meaning the same tooling that can help defenders find bugs faster can also compress the time between “vulnerability exists” and “vulnerability gets found,” by anyone, good or bad actor. Separately, security firm Blockaid reported that crypto projects lost more than $1 billion to hacks in just the first half of 2026, already exceeding the total for all of 2025, and Coinbase scaled back its own bug bounty payouts specifically because AI-generated submission volume had made the program harder to run productively.
None of this means Bitcoin’s open, auditable architecture is broken. The system caught all four of these problems, eventually, and none of them resulted in a structural failure of the protocol itself. But “eventually” is doing real work in that sentence, and the gap between when a weakness exists and when it gets caught is exactly the window that determines whether you’re the person who loses funds or the person who reads about someone else losing funds.
This is the part I actually want you to act on, not just read. I’ve ordered it by how much it matters and how quickly you can realistically do it.
If any part of your holdings sits on a Coldcard device, go check Coinkite’s official advisory against your specific device and the firmware version that was active when your seed was originally generated. This is not a “someday” task. If your device and generation window fall in the affected range, the fix is not a firmware update, it’s generating an entirely new seed and migrating funds. Firmware updates do not retroactively strengthen a seed that was already generated weak.
If you’re not on a Coldcard, the actionable version of this lesson still applies to you: do you actually know how your current seed was generated? Pure hardware RNG, with no independent verification? A hardware RNG supplemented by your own entropy, dice rolls, a passphrase, something outside the device’s control? If the honest answer is “I trust the device completely and have never thought about it further,” that’s worth revisiting, not out of paranoia, but because this month demonstrated concretely what happens when that trust turns out to be misplaced.
Boltz’s shutdown didn’t cost anyone funds, because it was non-custodial. But it cost real functionality, with zero warning, to anyone whose wallet quietly routed swaps through it. Go through your own setup and ask, honestly, which pieces of it depend on infrastructure you don’t control, even non-custodial infrastructure. A swap service. A specific relay. A specific Lightning Service Provider for inbound liquidity. None of these dependencies are inherently wrong, but knowing where they are means you’re not caught flat-footed when one of them disappears.
If you’re running your own LND node, this is a good prompt to actually check, not assume, a few specifics: are you still running a reasonably current version, given how fast both BIP-110-style consensus questions and infrastructure-level attacks are moving right now? Is Tor still properly configured, with stream isolation enabled, not just nominally turned on? Are your channels genuinely diversified, or have they quietly consolidated toward a small number of large hub nodes over time, the exact structural trend I flagged in an earlier data-focused piece?
This is the least technical item on this list and arguably the most important. The squeeze happened in the same four-week window as three separate security and governance stories, and none of those stories became less true because the price went up 25% in five days. If a good week in the market has you feeling more confident about Bitcoin generally, that’s a completely reasonable reaction to the price. It should have zero bearing on whether you actually go check the first three items on this list. The unglamorous infrastructure work is exactly the thing people skip when the news feels good, and exactly the thing that matters regardless of what the chart is doing.
This last one is less a checklist item and more a broader point worth sitting with given everything above. A month like this one, hardware risk, protocol governance risk, infrastructure risk, and market volatility all surfacing within weeks of each other, is a good moment to think about where you actually transact. Centralized, KYC exchanges concentrate a specific kind of counterparty and surveillance risk. Non-custodial, peer-to-peer alternatives remove that specific risk but require you to actually understand your own security setup, which is precisely what this checklist is about.
This is also, plainly, why I built and continue to run MostroEuropa, a European coordinator for the Mostro protocol, a non-custodial, no-KYC peer-to-peer Bitcoin exchange running entirely on Lightning and Nostr. No company custodies your funds at any point in a trade. No passport scan. If a month like this one has you thinking harder about where and how you actually acquire or sell Bitcoin, it’s worth a look: mostroeuropa.shadowbip.com
Four stories, one pattern. Coldcard showed what happens when a safeguard checks the wrong thing. BIP-110 showed what happens when a mechanism gets copied without the substance that made it work the first time. Boltz showed what happens when defense stops scaling at the same rate as attack. And the squeeze showed, from a completely different angle, that a market’s assumptions can unwind just as fast as a security assumption can.
None of these are reasons to panic. They’re reasons to actually do the boring, specific, checkable things above, this week, while the pattern is fresh in mind, rather than after the next headline makes it urgent again.
Related reading on this Substack:
$38 Million Gone in 25 Minutes: What the Coldcard Vulnerability Actually Means (free)
AI vs AI: How Boltz’s Shutdown Reveals Bitcoin’s New Threat Model (free)
Buy and sell Bitcoin peer-to-peer, no KYC, no custodian: MostroEuropa
⚡ Zap me: zap@shadowbip.com 🐙 GitHub: https://github.com/shadowbipnode