Uploaded August 2026 | Updated September 2026, 2 weeks ago
🚨 CHECK OUT TBL PULSE: research.thebitcoinlayer.com
In this episode, Nik welcomes back Alex Thorn of Galaxy Research on the Coldcard key generation vulnerability and the theft that followed. Alex explains how a March 17, 2021 firmware change left the devices silently defaulting to a much weaker random number generator, a bug that went unfound for five years, and why the victims are self-custody holders who never leaked a key or made a mistake. He walks through Galaxy's on-chain tracing across three confirmed waves totaling roughly 1,350 bitcoin, or about $88 million, why the stolen coins are sitting inert, how cheap compute and open source AI models made the exploit trivial, and what Coldcard owners should consider doing now.
Get Nik's weekly bitcoin and macro research: thebitcoinlayer.com/subscribe
The Bitcoin Layer is proud to be sponsored by SOUND HSA. A Health Savings Account is the most tax-advantaged account in the US tax code: contributions are tax-deductible, growth is tax-free, and withdrawals for qualified healthcare expenses are tax-free too. But most people leave their HSA sitting in cash, losing purchasing power year after year. SOUND HSA lets you hold real bitcoin inside your HSA instead. Not an ETF, not a paper claim, but real bitcoin secured in multi-institutional, multi-signature cold storage. Use code TBL to waive the fifty-dollar setup fee. Transfer an existing HSA or open a new one today: soundhsa.com
Timestamps:
00:00 A difficult few days for bitcoin self-custody
00:55 The March 17, 2021 firmware bug that went unfound for five years
03:17 Why coldcard owners are the humblest sat stackers
05:39 Galaxy's UTXO stack and how Block spotted the first pattern
07:57 Wave one: 1,082 bitcoin drained in 41 minutes
10:19 Wave three and the 293 script hash vaults
12:47 Wave four, copycats, and whether this is one attacker
17:28 Why multisig holders were not affected
19:54 How the attack actually works, bottom up and top down
23:57 Rentable compute, open source models, and the AI fingerprints
27:18 Tracking the attackers and whether victims can be made whole
32:52 Proving ownership, filing reports, and legal liability
35:08 Entropy standards and whether other hardware wallets are safe
37:36 Collaborative custody and the blow to self-custody
40:02 The AI arms race between attackers and defenders
43:18 Alex's offer of free help to victims
📊 The Bitcoin Layer is a bitcoin and global macroeconomic research firm.
▶️ Subscribe and turn on notifications for TBL on YouTube.
🎙 Subscribe to The Bitcoin Layer on your favorite podcast platform.
🐦 Follow TBL on X: /thebitcoinlayer
Nik Bhatia's Twitter: /timevalueofbtc
Researcher Demian Schatt's Twitter: https://x.com/demianschatt
Lead Statistician Augustine Carrasco Twitter: https://x.com/AugustineCarrB
🚨 CHECK OUT TBL PULSE: research.thebitcoinlayer.com
In this episode, Nik welcomes back Alex Thorn of Galaxy Research on the Coldcard key generation vulnerability and the theft that followed. Alex explains how a March 17, 2021 firmware change left the devices silently defaulting to a much weaker random number generator, a bug that went unfound for five years, and why the victims are self-custody holders who never leaked a key or made a mistake. He walks through Galaxy's on-chain tracing across three confirmed waves totaling roughly 1,350 bitcoin, or about $88 million, why the stolen coins are sitting inert, how cheap compute and open source AI models made the exploit trivial, and what Coldcard owners should consider doing now.
Get Nik's weekly bitcoin and macro research: thebitcoinlayer.com/subscribe
The Bitcoin Layer is proud to be sponsored by SOUND HSA. A Health Savings Account is the most tax-advantaged account in the US tax code: contributions are tax-deductible, growth is tax-free, and withdrawals for qualified healthcare expenses are tax-free too. But most people leave their HSA sitting in cash, losing purchasing power year after year. SOUND HSA lets you hold real bitcoin inside your HSA instead. Not an ETF, not a paper claim, but real bitcoin secured in multi-institutional, multi-signature cold storage. Use code TBL to waive the fifty-dollar setup fee. Transfer an existing HSA or open a new one today: soundhsa.com
Timestamps:
00:00 A difficult few days for bitcoin self-custody
00:55 The March 17, 2021 firmware bug that went unfound for five years
03:17 Why coldcard owners are the humblest sat stackers
05:39 Galaxy's UTXO stack and how Block spotted the first pattern
07:57 Wave one: 1,082 bitcoin drained in 41 minutes
10:19 Wave three and the 293 script hash vaults
12:47 Wave four, copycats, and whether this is one attacker
17:28 Why multisig holders were not affected
19:54 How the attack actually works, bottom up and top down
23:57 Rentable compute, open source models, and the AI fingerprints
27:18 Tracking the attackers and whether victims can be made whole
32:52 Proving ownership, filing reports, and legal liability
35:08 Entropy standards and whether other hardware wallets are safe
37:36 Collaborative custody and the blow to self-custody
40:02 The AI arms race between attackers and defenders
43:18 Alex's offer of free help to victims
📊 The Bitcoin Layer is a bitcoin and global macroeconomic research firm.
▶️ Subscribe and turn on notifications for TBL on YouTube.
🎙 Subscribe to The Bitcoin Layer on your favorite podcast platform.
🐦 Follow TBL on X: /thebitcoinlayer
Nik Bhatia's Twitter: /timevalueofbtc
Researcher Demian Schatt's Twitter: https://x.com/demianschatt
Lead Statistician Augustine Carrasco Twitter: https://x.com/AugustineCarrB
