So Coldcard is already out of the news cycle? Who keeps reporting on funds lost and their whereabouts? What's happening? Are people suing the company? Is Coinkite planning to reimburse people?
There's little news other than Coinkite reporting more vulnerabilities to my understanding around USB access to Coldcard data and as a consequence the signing flow not signing what it claims to sign, leaving room to swap details.
Coldcard: Want to send 1BTC to Alice?
You: Yes.
Companion app updates the transaction in RAM
Coldcard goes on to sign "send 12BTC to Bob ..."
npub1gm…78rf6
2026-08-22 12:05:26 UTC
Author Public Key
npub1gm7tuvr9atc6u7q3gevjfeyfyvmrlul4y67k7u7hcxztz67ceexs078rf6Published at
2026-08-22 12:05:26 UTCEvent JSON
{
"id": "8bad51f93b960cc164e56e8e572f39ea3c4e8ffc9ac8197889513832496e3ccf",
"pubkey": "46fcbe3065eaf1ae7811465924e48923363ff3f526bd6f73d7c184b16bd8ce4d",
"created_at": 1787400326,
"kind": 1,
"tags": [
[
"client",
"jumble"
]
],
"content": "So Coldcard is already out of the news cycle? Who keeps reporting on funds lost and their whereabouts? What's happening? Are people suing the company? Is Coinkite planning to reimburse people?\n\nThere's little news other than Coinkite reporting more vulnerabilities to my understanding around USB access to Coldcard data and as a consequence the signing flow not signing what it claims to sign, leaving room to swap details.\n\nColdcard: Want to send 1BTC to Alice?\nYou: Yes.\nCompanion app updates the transaction in RAM\nColdcard goes on to sign \"send 12BTC to Bob ...\"",
"sig": "f263e3b0d15623564823eae350536e14488ecead1eebea0cfe69a894c1eaaa508bc60c4c842775ce2ddc61d8e61d808282bbf062419a325c3fbb10dc1e17c736"
}