The private Bitcoin transaction service lets users bypass the public mempool as a Coldcard seed-phrase flaw tied to March 2021 code has exposed more than 5,200 wallets.
MARA Holdings, the Nasdaq-listed bitcoin miner and artificial intelligence (AI) infrastructure provider formerly known as Marathon Digital, has made its Slipstream transaction service available as a permissionless public good without a client code requirement. The change gives users a private path to submit signed Bitcoin transactions directly to MARA's mining pool instead of broadcasting them through the mempool (public waiting area for unconfirmed transactions), where other network participants can inspect them before confirmation. The update arrives as users rush to move funds after researchers disclosed a Coldcard hardware wallet flaw at the end of July. The issue traced back to a firmware coding error from March 2021 that caused affected models to fall back to a weaker software process, rather than the device's dedicated hardware generator, when creating 24-word seed phrases. The mistake reduced effective randomness from an expected 128 bits to roughly 40 bits on older models and 72 bits on newer ones, making it materially easier for attackers with enough computing power to guess seeds and unlock wallets. Loss estimates have climbed quickly. Early counts showed around 594 BTC, close to $38 million at the time, drained from roughly 500 addresses. Later estimates lifted the total to between $70 million and $88 million. As of Aug. 4, hackers are estimated to have stolen 1,816 BTC worth about $116 million from more than 5,200 distinct wallets. Slipstream is being treated as a practical response for Coldcard users because it reduces the chance that attackers can intercept a rescue transaction. Publicly broadcasting a transaction from a multi-signature setup (wallet shared across multiple keys) can reveal keys and spending conditions. An attacker already holding a matching weak private key can then attempt a higher-fee replacement using Replace-by-Fee, or RBF (Bitcoin fee-bumping mechanism), before the original transaction confirms. By keeping the transaction out of the public mempool until MARA mines it into a block, Slipstream removes much of that exposure window. MARA first launched Slipstream on Feb. 22, 2024, to help large or unusual transactions that many Bitcoin nodes would not relay under standard policy. CEO Fred Thiel said at the time it was a way to use MARA's mining infrastructure for advanced bitcoin users while staying within Bitcoin's rules. The service still depends on MARA finding blocks, and at publication the company's pool controlled over 5% of Bitcoin's total hashpower, so confirmation timing depends on its mining success. MARA has told users to keep fees competitive but not excessive because transactions can remain stuck in its private queue if network rates spike. The broader bitcoin community is viewing the public relaunch as a targeted security tool rather than a replacement for the normal public mempool, and attention is now on updated theft estimates, Coldcard guidance on affected firmware versions and serial ranges, and whether other miners offer similar private submission channels.