Coldcard Attack Ongoing; Users Urged to Verify Settings

The notable shift here is that a hardware-wallet maker's own ecosystem is being treated as an active incident rather than a past one, with an exchange's research arm effectively running victim support and attacker intelligence. That matters because it blurs the line between vendor responsibility and third-party forensics, and it puts pressure on Coldcard users to self-verify settings rather than wait for a fix. Whether the flow of new victims slows, and whether the intelligence gathered translates into attribution or recovery, is the open question.