Coldcard Firmware Bug Lets Attacker Drain 1,800+ BTC From Hardware Wallets

,

, etc. Let's translate paragraph by paragraph. Original: "On July 30, 2026, an attacker began systematically draining Bitcoin from Coldcard hardware wallets, exploiting a firmware entropy bug that had been sitting in the code for years. The first wave of the attack moved 1,082.65 BTC, which still sits untouched in the attacker's address, and confirmed losses have now passed $118 million across more than 5,000 addresses." Translation: "2026年7月30日，一名攻击者开始系统性地从Coldcard硬件钱包中盗取比特币，利用了一个在代码中潜伏多年的固件熵漏洞。第一波攻击转移了1,082.65枚BTC，这些BTC至今仍留在攻击者的地址中，而确认的损失已超过1.18亿美元，涉及超过5,000个地址。" Note: "entropy bug" -> "熵漏洞". "sitting in the code for years" -> "在代码中潜伏多年". "confirmed losses" -> "确认的损失". "$118 million" -> "1.18亿美元". "more than 5,000 addresses" -> "超过5,000个地址". Next h2: "The attack in waves" -> "攻击分波进行" or "攻击的波次". I'll use "攻击分波次进行". Paragraph: "The initial wave was surgical. On-chain analysts, including Alex Thorn at Galaxy Research, tracked the activity through pattern analysis and voluntary victim reports. Thorn said law enforcement may already know the identity of the Wave 1 attacker." Translation: "第一波攻击精准无比。包括Galaxy Research的Alex Thorn在内的链上分析师通过模式分析和受害者自愿报告追踪了这一活动。Thorn表示，执法部门可能已经知道第一波攻击者的身份。" Note: "surgical" -> "精准" or "外科手术式". I'll use "精准". "On-chain analysts" -> "链上分析师". "pattern analysis" -> "模式分析". "voluntary victim reports" -> "受害者自愿报告". "Wave 1 attacker" -> "第一波攻击者". Next paragraph: "Later waves look different. Smaller, faster, and with distinct operational patterns, they suggest other actors reverse-engineered the weak seed space after the vulnerability became public. Self-reported confirmed drains slowed sharply after August 6, but that doesn't mean the threat is gone. Many potentially vulnerable seeds generated on the affected firmware remain at risk." Translation: "后续的波次看起来有所不同。规模更小、速度更快，且操作模式各异，表明其他攻击者在漏洞公开后对弱种子空间进行了逆向工程。自8月6日以来，自我报告的确认盗取事件急剧减少，但这并不意味着威胁已消除。许多在受影响固件上生成的潜在易受攻击的种子仍然面临风险。" Note: "reverse-engineered" -> "逆向工程". "weak seed space" -> "弱种子空间". "self-reported confirmed drains" -> "自我报告的确认盗取事件". "slowed sharply" -> "急剧减少". "remain at risk" -> "仍然面临风险". Next h2: "Clues from the investigation" -> "调查中的线索" Paragraph: "Clay Garrett, engineering lead at Block (Bitkey), reported that the attacker used a paid account at a blockchain-services provider. Internal logs matched the theft pattern with 'extraordinary specificity,' Garrett said, and the information was shared with authorities. That detail narrows the field — whoever pulled this off left a digital trail that points to a real-world identity." Translation: "Block（Bitkey）的工程负责人Clay Garrett报告称，攻击者使用了区块链服务提供商的付费账户。Garrett表示，内部日志与盗窃模式'高度吻合'，这些信息已与当局共享。这一细节缩小了范围——无论谁实施了这次攻击，都留下了指向现实身份的数字痕迹。" Note: "blockchain-services provider" -> "区块链服务提供商". "extraordinary specificity" -> "高度吻合" or "极其具体". I'll use "高度吻合". "narrows the field" -> "缩小了范围". "digital trail" -> "数字痕迹". "real-world identity" -> "现实身份". Next paragraph: "Still, the full scope is murky. Confirmed and estimated losses exceed 1,800 BTC from more than 5,000 addresses, with total estimated losses over 2,000 BTC. The gap between confirmed and estimated is a reminder that many victims haven't come forward yet." Translation: "然而，整体损失范围尚不明朗。确认和估计的损失超过1,800枚BTC，涉及超过5,000个地址，总估计损失超过2,000枚BTC。确认与估计之间的差距提醒我们，许多受害者尚未现身。" Note: "murky" -> "不明朗". "confirmed and estimated losses" -> "确认和估计的损失". "haven't come forward" -> "尚未现身" or "尚未站出来". Next h2: "A bug Coinkite knew about" -> "Coinkite已知的漏洞" Paragraph: "This isn't a novel attack vector. Back in October 2021, Coinkite discussed a 'retirement attack' — a scenario where project makers could plant a bug in entropy generation for later retrieval. That description matches the 2026 vulnerability almost exactly. The company talked about the risk publicly, but the bug still made it into firmware and stayed there for years." Translation: "这并非新颖的攻击方式。早在2021年10月，Coinkite就讨论过'退休攻击'——即项目制造者可能在熵生成中植入漏洞以供日后提取。这一描述与2026年的漏洞几乎完全吻合。该公司曾公开讨论过这一风险，但该漏洞仍被引入固件并潜伏多年。" Note: "novel attack vector" -> "新颖的攻击方式". "retirement attack" -> "退休攻击" (keep as is). "plant a bug" -> "植入漏洞". "entropy generation" -> "熵生成". "matches almost exactly" -> "几乎完全吻合". "made it into firmware" -> "进入固件". Next h2: "Who's behind it?" -> "幕后黑手是谁？" Paragraph: "Some in the Bitcoin space suspect an inside job at Coinkite. The evidence so far is circumstantial — no definitive link has been established. But the combination of a long-standing entropy flaw, the attacker's apparent access to paid blockchain services, and the precise targeting of Coldcard devices keeps that question open." Translation: "比特币圈内的一些人怀疑Coinkite内部有人作案。目前证据都是间接的——尚未确立明确关联。但长期存在的熵缺陷、攻击者明显使用付费区块链服务以及针对Coldcard设备的精准打击，这些因素使这个问题悬而未决。" Note: "inside job" -> "内部作案" or "内鬼". I'll use "内部作案". "circumstantial" -> "间接的". "definitive link" -> "明确关联". "apparent access" -> "明显使用". "precise targeting" -> "精准打击". "keeps that question open" -> "使这个问题悬而未决". Next paragraph: "The next concrete step is likely forensic: whether law enforcement acts on the identity clues Thorn and Garrett pointed to, and