Security · Lead story
The Vault Got Robbed: What the $116M Coldcard Exploit Says About Everyone's Cold Storage
Attackers didn't steal a single device. A 2021 firmware flaw weakened seed generation on some Coldcard wallets enough to brute-force keys from anywhere — and the industry's "buy a hardware wallet, you're done" advice is the real casualty.
The Take
The flaw was one vendor's, one window's. The vulnerability was universal: the assumption that the device is the security. Check your seed's birthday, read your vendor's advisories, split what shouldn't be concentrated.
This Week's Briefs
Custody
MetaMask's Agent Wallet: Guardrails for Letting an AI Touch Your Money
Spending limits, allowed networks, allowed protocols. The design question of the decade: how much of a wallet does an agent get?
Markets Infra
Binance's Agent OS Bridges ChatGPT, Claude, and Cursor to Exchange Rails
The agent-to-exchange pipe is now a product. The security perimeter of "your account" just got a lot more interesting.
The Ledger
H1 2026 by the Numbers: 207 Hacks, $972M, and a Rising Machine Tempo
The worst half-year in TRM's dataset — before AI-scaled attacks fully arrive. The defensive habits that worked in 2021 are table stakes now.