# Coldcard Wallet Risk Emerges as Grassroots Bitcoin Spending Expands *By Bitcoin Payment Adoption Tracker • July 31, 2026* A reported Coldcard entropy failure with active exploitation becomes the period’s main payment-infrastructure risk, alongside fresh merchant-use signals from a chicken-farm circular economy and Bitcoin-payable tuk-tuk transport in El Salvador. ## Major Adoption News ### Food sold and bought inside a Bitcoin loop Bitcoin Chama reported that Jusper bought chickens from its community chicken-coop project with Bitcoin rather than cash or mobile money. The group says the community grows the food, sells it, pays in Bitcoin and saves in Bitcoin, explicitly framing the arrangement as a circular economy without banks or middlemen. [^1] A companion post publishes the `Nyarandi@8333.mobi` payment address, links BTC Map merchant 33198 and tags the activity `#SPEDN`. [^2] The linked map record labels the site “Chicken farm” at Chirichiro-Birongo Road, Masimba ward, and displays an acceptance marker. [^3] The business significance is the integration of Bitcoin into a local production-and-sales loop, not merely another standalone acceptance announcement. ### Bitcoin-payable transport in Berlín, El Salvador Bitcoin Berlin SV promoted Erick’s tuk-tuk service for passengers arriving at the Berlín bus terminal, explicitly saying riders can pay with Bitcoin and providing a phone/WhatsApp contact. [^4] The account’s earlier Berlín material identifies the town as being in El Salvador and also promoted Bitcoin payment at a local hostal. [^5] The new transport offer extends Bitcoin acceptance from lodging into an arrival and last-mile service. ## Payment Infrastructure ### Coldcard wallet security becomes a payment constraint Block’s Bitcoin Engineering and Security teams said they had root-caused vulnerabilities allowing theft of Bitcoin from COLDCARD users and that active exploitation was under way, while also cautioning that they had not completed full empirical testing and that the advisory represented Block’s current opinion. [^6] The reported technical cause is an RNG integration error: `ngu.random` uses MicroPython’s deterministic Yasmarang fallback instead of the STM32 hardware RNG. [^6] The reported scope is broader than one device generation. Mk2/Mk3 firmware v4.0.0–v4.1.9 is listed as a confirmed vulnerable path; Mk4 production firmware, Q and Mk5 retain the fallback with a reseed limited to 32 bits. Exposure depends on the firmware used when the secret was generated, and upgrading does not repair an existing seed. [^6] Block says a sufficiently constrained device UID, timer state and RNG-call history could let an attacker reproduce the fallback stream; a recovered seed or private key permits theft of associated funds. [^6] Moving a seed generated on a vulnerable Coldcard to another wallet does not remove the underlying weakness. [^6] This is a payment-infrastructure risk rather than an adoption gain: wallets that sign or hold payment funds depend on secure key generation. The incident’s scale and exact attack path were still unsettled in contemporaneous discussion—one security post described a small minority of users as affected but said the attack mechanism remained unknown. [^7] Bitcoin Jungle nevertheless issued an urgent warning to Coldcard users without a strong passphrase. [^8] ### Bitcoin-settled private ecash CalleBTC highlighted Minerva Mint as “Ark-backed Cashu ecash” consisting of private bearer tokens settled on Bitcoin, and linked the service website. [^9][^10] This adds a privacy-oriented payment primitive to the monitored infrastructure set, but the post supplies no transaction, fee, liquidity or user-adoption data; it is an infrastructure signal, not evidence of deployed scale. ## Regulatory Landscape No qualifying regulatory item is included: the material reviewed for this period yielded merchant and payment-infrastructure developments, but no country-specific legal, tax or legal-tender change affecting Bitcoin payments. ## Usage Metrics The period’s usage evidence is concrete but not statistical. It records one named chicken purchase without a sat amount, a payment address and merchant-map listing for the associated chicken-farm activity, and one Bitcoin-payable tuk-tuk offer. [^1][^2][^4] No transaction volume, merchant total, adoption rate or growth series is stated, so the evidence supports directional adoption—not a quantified trend. ## Emerging Markets - **Masimba ward:** Bitcoin Chama’s evidence connects food production, sale, payment and saving within one community loop; the associated listing gives the activity a discoverable merchant endpoint. [^1][^2][^3] - **El Salvador:** Bitcoin Berlin SV’s tuk-tuk offer shows Bitcoin being positioned for local transport at a bus-terminal gateway, complementing the account’s earlier lodging acceptance in Berlín. [^4][^5] These are service-level signals in specific communities, not evidence of national-scale payment penetration. ## Adoption Outlook The period shows Bitcoin functioning as a medium of exchange in two practical settings: community-produced food in Masimba ward and last-mile transport in Berlín. The Chama example is the stronger adoption signal because it links earning, selling, paying and saving in one local loop, while the tuk-tuk post broadens the range of everyday services accepting Bitcoin. [^1][^4] At the infrastructure layer, Minerva Mint points toward more private Bitcoin-settled payment flows, but without usage data it remains an early signal. The countervailing development is the Coldcard incident: active-exploitation claims and the inability to repair an already generated vulnerable seed make wallet security a direct condition for reliable payment use. [^9][^6] With no volume or regulatory data, payment momentum is observable but cannot yet be measured at market scale. --- ### Sources [^1]: [𝕏 post by @Bitcoinchama](https://x.com/Bitcoinchama/status/2082702658335355386) [^2]: [𝕏 post by @Bitcoinchama](https://x.com/Bitcoinchama/status/2082703095616664048) [^3]: [Chicken farm - BTC Map](https://btcmap.org/merchant/33198) [^4]: [𝕏 post by @BitcoinBerlinSV](https://x.com/BitcoinBerlinSV/status/2082869501205389424) [^5]: [𝕏 post by @BitcoinBerlinSV](https://x.com/BitcoinBerlinSV/status/2080799230273155250) [^6]: [Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmware](https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware) [^7]: [𝕏 post by @KLoaec](https://x.com/KLoaec/status/2082903597767888991) [^8]: [𝕏 post by @BitcoinJungleCR](https://x.com/BitcoinJungleCR/status/2083031138985980071) [^9]: [𝕏 post by @callebtc](https://x.com/callebtc/status/2082847915974783275) [^10]: [𝕏 post by @callebtc](https://x.com/callebtc/status/2082847918369742891)