MARA Opens Slipstream to the Public as Coldcard Victims Race to Escape

MARA Strips Away the Access Codes

MARA Holdings, the Nasdaq-listed bitcoin miner and artificial quality (AI) infrastructure provider, formerly known arsenic Marathon Digital, built the Slipstream service truthful radical tin nonstop bitcoin transactions consecutive to its mining excavation alternatively of broadcasting them to the nationalist network.

Most bitcoin transactions question done a shared waiting country called the mempool, wherever each node connected the web tin spot a transaction earlier it gets confirmed into a block. Slipstream skips that waiting room. A idiosyncratic submits a signed transaction straight to MARA, and it stays hidden until MARA mines a artifact with it inside.

On August 3, 2026, MARA Foundation posted the update connected X:

“MARA Slipstream is present disposable arsenic a permissionless nationalist bully with nary lawsuit codification requirement. Please beryllium cautious and blimpish with fees to debar transactions getting stuck successful the Slipstream mempool successful the lawsuit that competitory rates spike. For the foreseeable future, we are not charging further fees for this service, but users are liable for paying due Bitcoin transaction fees.”

That past constituent matters. MARA is not adding its ain surcharge. Users inactive wage mean Bitcoin web fees, they conscionable nonstop the transaction done a backstage transmission alternatively of the unfastened one.

A Hardware Wallet Flaw Forces the Timing

The timing is not a coincidence. At the extremity of July, researchers disclosed a superior flaw successful Coldcard hardware wallets, tracing backmost to a firmware coding mistake from March 2021. Instead of pulling randomness from the device’s dedicated hardware generator, affected Coldcard models fell backmost to a weaker bundle process erstwhile creating a wallet’s 24-word effect phrase. That mistake chopped the effectual randomness from an expected 128 bits down to astir 40 bits connected older models and 72 bits connected newer ones. Fewer imaginable combinations means an attacker with capable computing powerfulness tin conjecture the effect and unlock the wallet.

Hackers Race to Drain Weak Wallets

Attackers moved fast. Early tallies counted astir 594 BTC, adjacent to $38 cardinal astatine the time, drained from astir 500 addresses. Later estimates enactment the full person to $70 cardinal to $88 cardinal arsenic much compromised wallets came to light. As of Aug. 4, it is estimated that the hackers person stolen an estimated 1,816 BTC, worthy astir $116 million, from much than 5,200 chiseled wallets.

A firmware spot stops caller wallets from inheriting the flaw, but it does thing for effect phrases already generated nether the breached code. Anyone who acceptable up a Coldcard during the affected years has to determination their coins to a caller wallet.

Moving Funds Publicly Creates Its Own Trap

For radical using multi-signature setups, communal among Coldcard users who divided power of funds crossed respective devices, the migration itself carries risk. Broadcasting a transaction publically reveals the wallet’s keys and spending conditions. An attacker already holding a matching anemic backstage cardinal tin spot that transaction, physique a competing 1 with a higher fee, and usage a Bitcoin web diagnostic called Replace-by-Fee (RBF) to leap the enactment and bargain the funds earlier the archetypal transaction confirms.

MARA’s Slipstream removes that model of exposure. Because the transaction ne'er touches the nationalist mempool, an attacker ne'er sees the keys oregon the spending details until MARA has already mined the coins into a confirmed block.

Slipstream Predates the Crisis by Two Years

MARA first launched Slipstream connected February 22, 2024, aiming to assistance ample oregon antithetic transactions that galore Bitcoin nodes diminution to relay nether modular policy. CEO Fred Thiel framed it astatine the clip arsenic a mode to enactment MARA’s mining infrastructure to enactment for precocious bitcoin users portion staying wrong the rules of the protocol. Access had antecedently required a lawsuit codification during periods of precocious request oregon maintenance. That request is present gone.

Users Still Carry the Trust and Timing Risk

Slipstream inactive depends connected MARA uncovering blocks. A transaction sits successful MARA’s backstage queue until the excavation mines one, truthful timing depends wholly connected MARA’s stock of Bitcoin’s full hashrate.

Mining excavation organisation connected Aug. 4, 2026, via mempool.space. As of today, MARA commands 5.37%.

At the clip of publication, MARA’s excavation commands implicit 5% of the aggregate hashpower powering Bitcoin. MARA is telling users to support fees competitory but not excessive, since a transaction stuck successful its backstage queue during a interest spike could beryllium for a portion earlier confirming.

What Comes Next for Coldcard Holders

The broader bitcoin assemblage is treating Slipstream’s nationalist relaunch arsenic a applicable instrumentality for a information crisis, not a imperishable displacement successful however astir transactions should move. For mundane transfers, the public mempool remains the modular route. But for Coldcard users inactive holding coins connected compromised seeds, information researchers and wallet developers person been pointing to Slipstream arsenic 1 of the much reliable ways to determination funds without tipping disconnected attackers first.

Watch for updated nonaccomplishment estimates arsenic much compromised addresses surface, further guidance from Coldcard connected which firmware versions and serial ranges are affected, and whether different miners travel MARA successful offering a akin backstage submission path.