Bitcoiners who followed self-custody best practices — air-gapped devices, steel seed plates, safety deposit boxes — describe watching years of savings disappear in minutes as attackers exploiting the Coldcard flaw drained more than $114 million.

A firmware bug that shipped in 2021 made Coldcard seeds guessable, and attackers have drained more than 1,800 BTC since Thursday. The latest sweep can still be outbid in the mempool, giving some victims a window to rescue their coins.