Galaxy Research tied a Coldcard firmware seed-generation bug to 1,083 BTC (~$70M) drained from 1,196 addresses in a 41-minute July 30 window. Coinkite expanded its advisory across Mk3/Mk4/Mk5/Q models and pushed emergency updates; users must regenerate seeds. Same-attacker pattern confirmed, but future exploits remain possible on any affected wallet.(unfolded.)