A Wallet Flaw and a Landmark Sale: Two Reality Checks Hit Bitcoin's Biggest Holders This Week
Bitcoin has been trading in a tight band near $63,000–$64,000 this week, and on the surface the market looks calm. Underneath that calm, though, two separate stories are reshaping how seriously American investors think about custody risk and corporate treasury behavior.
The Coldcard Flaw: When Self-Custody Isn't as Safe as It Sounds
Coinkite, the Canadian maker of the popular Coldcard hardware wallet, disclosed in late July that a firmware bug had been silently weakening the randomness behind newly generated Bitcoin seed phrases since March 2021. Instead of pulling from the device's dedicated hardware random number generator, affected firmware versions fell back to a predictable software-based substitute, cutting the effective randomness of a seed from an intended 128 bits down to as little as 40 bits on the most exposed devices — weak enough for an attacker to feasibly guess.
The flaw was affecting Coldcard Mk3 devices on firmware 4.0.1 through 4.1.9 most severely, with Mk3, Mk4, Mk5 and Q devices on later firmware carrying a somewhat smaller but still significant risk of around 72 bits. On July 31, someone exploited the weakness directly: roughly 594 BTC, worth about $38 million at the time, was swept out of some 500 single-signature wallets in a window of just 25 minutes, with the funds consolidated into a single address. Broader estimates of total exposure across affected devices run as high as 1,300 BTC, or $70–90 million, though Coinkite has not confirmed every reported theft is tied to the same root cause.
Coinkite has since shipped patched firmware, is urging every affected user to generate a fresh seed rather than simply update, and has begun destroying remaining vulnerable device inventory. Rival hardware wallet makers Trezor and Ledger have said their devices were not affected, since they use different processes for generating randomness. For the broader self-custody community, the episode is a pointed reminder that owning your own keys only protects you as well as the process that created them in the first place — a single build-configuration error was enough to quietly undermine a device millions of dollars had been entrusted to.
Strategy Sells Bitcoin — a First for the Company's Public Playbook
The second story concerns Strategy (formerly MicroStrategy), the Virginia-based company that built its identity around buying Bitcoin and, in Executive Chairman Michael Saylor's words, essentially never selling. According to an SEC filing made public this week, Strategy sold 1,638 BTC between July 27 and August 2 at an average price of about $63,957 per coin, raising roughly $104.7 million — a price notably below the company's own average acquisition cost of $75,419 per Bitcoin.
The proceeds weren't reinvested into more Bitcoin. Instead, they were split roughly evenly between paying dividends on the company's STRC preferred stock and funding further repurchases of those same preferred shares, part of a broader effort to defend the instrument's value. Strategy also raised an additional $290 million by selling MSTR common shares in the same period, lifting its cash reserve to $4 billion. It marks the company's third disclosed Bitcoin sale of 2026, and notably, Strategy has not purchased any new Bitcoin in more than five weeks — an unusually long pause for a firm that built its market reputation on the opposite habit.
Even so, the sale left Strategy's core position essentially intact: the company still holds 842,138 BTC, worth well over $50 billion and equal to roughly 4% of Bitcoin's entire circulating supply, making it by a wide margin the largest corporate Bitcoin holder in the world. Notably, MSTR shares actually rose after the disclosure, suggesting investors read the move as prudent balance-sheet management rather than a loss of conviction in Bitcoin itself.
What These Two Stories Have in Common
Neither event moved Bitcoin's price dramatically — it has stayed resilient near $63,000–$64,000 through both. But together, they mark a shift in how sophisticated the risks facing US crypto holders have become. The Coldcard incident shows that hardware-level custody failures can undercut even careful, security-conscious users. The Strategy sale shows that even the most committed long-term corporate holders are willing to sell into weakness to protect their broader balance sheet when circumstances require it.
For everyday investors, the practical takeaway is straightforward: verify how your own seed was generated and consider a passphrase or multisig setup for meaningful holdings, and don't assume that a company's past buying behavior guarantees its future behavior. In a market still waiting on Washington for a finished regulatory framework, operational and balance-sheet risk are proving just as important to watch as the next headline out of Congress.
