Nunchuk's developers say multivendor multisig should be the standard after Ledger's reseller compromise
Bitcoin users moving to multivendor multisig after Coldcard and Ledger face a $285 device bill at the lowest listed prices, against $59 for one wallet. Wallet makers and services like Casa and Unchained could gain customers, news.bitcoin.com reported, but the cost may push some users to custodians.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+25
- Incentives70
- Confidence50
COLDCARD says its official X account posted a phishing link on October 11, despite offline two-factor protection the wallet maker has used since 2017. With no explanation yet from COLDCARD or X, a security alert seen on social media is worth acting on only once the maker's own website repeats it.
Perspective Coverage
5 publishers
- Builder
- Builder 15%
- Operator
- Operator 48%
- Investor
- Investor 37%
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+10
- Incentives55
- Confidence60
RippleX fixed a 2015-era XRP Ledger bug that let one payment create spendable XRP beyond the token's 100 billion supply cap. Both built-in safeguards would have missed it, so the cap's record on public networks rests on RippleX's finding of no exploitation.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+20
- Incentives60
- Confidence55
Bitget's wallet breach accounts for about four-fifths of September's crypto theft after returns
Bitget lost about $387.5 million to forged withdrawals from its wallet system, more than half of September's $742 million in crypto thefts. Most of Liquid Network's loss was handed back, so what stayed stolen sits mainly with one exchange's withdrawal infrastructure.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+8
- Incentives
- Not scored
- Confidence55
Peter Todd takes over the MARA channel that carried more than 9,000 BTC past the public mempool
Peter Todd, co-author of Bitcoin's replace-by-fee standard, now leads MARA's Slipstream, a private channel that moved over 9,000 BTC from vulnerable wallets. With two documented uses on record, both where public relay was risky or failed, the evidence that private routing is becoming a routine miner fee business is still thin.
Reality
- Evidence40
- Adoption25
- Hype gap+30
- Incentives55
- Confidence40
Coldcard owners who held their own keys lost over $100 million to a firmware bug
Coinkite's Coldcard firmware skipped its hardware random number generator, letting attackers brute-force seeds and drain over $100 million in bitcoin. Liquid's later $320 million drain adds node software to the code a bitcoin holder has to trust.
Reality
- Evidence38
- Adoption
- Not scored
- Hype gap+30
- Incentives
- Not scored
- Confidence42
The wallets held. The customer list did not: 39,798 names, phone numbers and shipping addresses, taken through commerce plumbing nobody threat-models.
Perspective Coverage
3 publishers
- Builder
- Builder 28%
- Operator
- Operator 55%
- Investor
- Investor 17%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+10
- Incentives55
- Confidence70
White hats move 52.37 BTC into a Wyoming statutory trust built for COLDCARD victims
The Crypto Recovery Trust, a Wyoming entity advised by Steptoe LLP, now controls coins worth about $3.5m at the exploit's implied price, against more than $100m that COLDCARD holders lost from July 30, 2026.
Reality
- Evidence28
- Adoption22
- Hype gap+34
- Incentives62
- Confidence34
Core Lightning says the machine-written reports found real flaws in its payments software. It is holding the count and severity for at least two weeks, leaving node operators to decide what to do with a hazard whose size is still private.
Perspective Coverage
3 publishers
- Builder
- Builder 28%
- Operator
- Operator 52%
- Investor
- Investor 20%
Reality
- Evidence60
- Adoption40
- Hype gap+25
- Incentives68
- Confidence62
Harmony blames state actors and AI agents for shutting the layer-1 it launched in 2019, and the money set aside to pay validators to power down is worth more than everything left locked on the chain it closes.
Perspective Coverage
3 publishers
- Builder
- Builder 30%
- Operator
- Operator 38%
- Investor
- Investor 32%
Reality
- Evidence55
- Adoption20
- Hype gap+45
- Incentives75
- Confidence60
Trezor's spoofed alert reused the language of the $112.7m Coldcard exploit
The email telling Trezor owners their recovery phrases might lack entropy came from a real trezor.io address and passed DKIM, SPF and DMARC, and it described a defect close to the one that took 1,778.84 BTC from Coldcard users.
Reality
- Evidence42
- Adoption55
- Hype gap+22
- Incentives58
- Confidence45
Ledger's lab took about 125 days to walk a laser flaw in Trezor's chip into public view
Both wallet makers say AI is shortening the distance between finding a bug and using one, which makes the pace of their own coordinated disclosure the number worth pricing, and the only loss they cite belongs to a rival vendor.
Reality
- Evidence34
- Adoption22
- Hype gap+33
- Incentives82
- Confidence33
Apple's report cap blocked a seven-person firm with a patched Mac bug to its name
Apple says AI-generated submissions are flooding its review pipeline, so it capped open vulnerability reports and added a 30-day cool-down. The one blocked researcher named so far had filed 13 reports across two years.
Reality
- Evidence40
- Adoption45
- Hype gap+38
- Incentives62
- Confidence45
ETF buying outruns the oldest bitcoin wallets by roughly ninety to one
Decade-dormant coins are moving at an unusual clip while Warsh talks the Fed hawkish, so the tempting read is old supply against ETF demand. Divide the two flows and one side is ninety-six times the other.
Reality
- Evidence38
- Adoption55
- Hype gap+26
- Incentives52
- Confidence44
The $20,000 red team: US guardrails push Bitcoin's defenders onto Chinese models
A volunteer group says it has swept almost all of Bitcoin's open-source ecosystem for AI-assisted exploits, and that American models' refusals made Chinese ones the default tool.
Reality
- Evidence28
- Adoption32
- Hype gap+34
- Incentives66
- Confidence44
Coinkite now makes Coldcard owners roll dice, after $130M walked out of air-gapped wallets
A 2021 seed flaw cut entropy from 128 bits to about 40, so no attacker needed to touch the hardware. Every seed generated before July 2026 now has to be replaced.
Reality
- Evidence62
- Adoption54
- Hype gap+14
- Incentives66
- Confidence58
Malwarebytes says fake crypto AML screening sites are draining wallets. The defence is unglamorous: a real basic check needs only a public address, so a connect prompt is the tell.
Reality
- Evidence57
- Adoption41
- Hype gap+12
- Incentives62
- Confidence60