Summary of AML Compliance Gaps Exposed
Published 8/2/2026, 11:39:15 AM
The Coldcard exploit (July 30, 2026) exposed critical gaps in exchange anti-money laundering (AML) compliance by demonstrating how hardware-level vulnerabilities can bypass traditional behavioral and risk-scoring heuristics. While the user query mentions a PSBT exploit, research indicates the primary 2026 event was a firmware entropy flaw that allowed attackers to recreate private keys and move 1,082.65 BTC (~$70.2 million) in a manner indistinguishable from legitimate owner activity [Source: https://www.theblock.co/post/410332/bitcoin-losses-linked-coldcard-vulnerability-70-million-galaxy-research].
Summary of AML Compliance Gaps Exposed
| Compliance Gap | Description | Impact of Coldcard Exploit |
|---|---|---|
| Transaction Attribution | Ability to distinguish between authorized and unauthorized moves. | Attackers moved funds using valid signatures, making the theft look like a "coin owner choosing to move coins" [Source: https://x.com/glxyresearch/status/2083181683067506899]. |
| Risk Scoring Integrity | Reliance on the "clean" history of long-term holder wallets. | Compromised wallets belonged to high-reputation "HODLers," bypassing flags for new or high-risk addresses [Source: https://www.coindesk.com/business/2026/07/31/coldcard-s-usd38-million-so-far-exploit-shakes-faith-in-self-custody-may-push-investors-to-etfs]. |
| Detection Latency | Time between exploit occurrence and exchange intervention. | The sweep occurred in just 41 minutes, leaving no time for exchanges to update blacklists or freeze incoming deposits [Source: https://www.theblock.co/post/410332/bitcoin-losses-linked-coldcard-vulnerability-70-million-galaxy-research]. |
| Input Validation | Verification of transaction construction (e.g., PSBTs). | While the 2026 event focused on entropy, previous concerns regarding PSBT manipulation highlight gaps in how exchanges verify the intent behind a signed transaction. |
Key Vulnerability Details
The exploit stemmed from a production configuration error where the hardware Random Number Generator (RNG) was disabled (MICROPY_HW_ENABLE_RNG set to zero). This forced the device to use a predictable software-based fallback for seed generation.
- Total Losses: Approximately 1,082.65 BTC stolen from 1,196 addresses [Source: https://www.theblock.co/post/410332/bitcoin-losses-linked-coldcard-vulnerability-70-million-galaxy-research].
- Execution Window: The primary sweep took place between 01:10:20 and 01:51:26 UTC on July 30, 2026.
- AML Evasion: By hijacking existing, "clean" private keys, attackers avoided the "new wallet" red flags that typically trigger enhanced due diligence (EDD) at major exchanges.
Implications for Exchange Compliance
The incident has led to calls for a "Hardware Vulnerability Registry" to help exchanges identify when deposits originate from known compromised firmware versions. Furthermore, the inability of self-custody users to defend against such flaws is reportedly pushing institutional investors toward regulated products like Spot Bitcoin ETFs, where AML and custody are managed by centralized entities [Source: https://www.coindesk.com/business/2026/07/31/coldcard-s-usd38-million-so-far-exploit-shakes-faith-in-self-custody-may-push-investors-to-etfs].
While the 2026 data focuses on the entropy flaw, the broader concern regarding PSBT-based manipulation (such as CVE-2020-29391) remains a theoretical gap where malformed files could trick devices into signing unintended inputs, further complicating an exchange's ability to verify transaction origin and user intent.