Bridge and Validator Compromises Took Roughly $32 Million as Coldcard Seed Losses Kept Growing

Three incidents documented by Rekt News share a root cause that no contract audit would have flagged, because in each case the code did what it was written to do.

The largest was AFX Trade. Attackers obtained five validator signatures, enough to clear the two-thirds threshold guarding the platform's dollar-token custody bridge on Arbitrum, and moved $24.15 million out of the contract through ordinary public transfers. The bridge validated the withdrawal correctly. What failed was the trust placed in that set of signers, not the verification logic itself.

VerusCoin lost $7.54 million from its Ethereum bridge, the second breach of the same bridge after an $11.6 million loss in May. Rekt describes it as a different gap inside the same trust boundary, which is the pattern that makes bridges the most repeatedly drained component in the industry. Separately, the payments processor Coinsbuy lost roughly $8.07 million across Tron and Ethereum in under an hour on 9 August, with wallets on both chains emptied almost simultaneously, a pattern consistent with compromised signing infrastructure rather than a contract flaw. The drained wallets were refilled within half a day, which suggests the operator absorbed the loss rather than passing it to users, though Coinsbuy has not published a full account.

The hardware-wallet failure that CoinDesk described in a report on wallet-security concerns that drove large bitcoin transfers between wallets remains the costliest of the group. A Coldcard firmware build shipped in March 2021 carried a setting that skipped the device's dedicated hardware randomness chip and fell back to a software generator seeded from the chip serial number and clock registers, cutting effective key entropy on the Mk3 model from 128 bits to roughly 40. That is guessable offline. A coordinated sweep on 30 July removed more than 1,082 bitcoin from about 1,196 wallets in roughly 41 minutes, and published estimates of total losses run from about $116 million across more than 5,200 addresses to as high as $130 million if a fourth wave is confirmed. Multiple independent attackers exploited the same defect, and none of them needed physical access to a device.