MARA opens Slipstream as Coldcard users rush to relocate funds

MARA Foundation opened its Slipstream private submission service to the public on Aug. 3, 2026, removing the prior client-code requirement as thousands of Coldcard hardware-wallet users moved funds after a firmware flaw reduced seed randomness.

Slipstream lets users submit signed Bitcoin transactions directly to MARA’s mining pool instead of broadcasting them to the public mempool. In a post on X, MARA wrote: “MARA Slipstream is now available as a permissionless public good with no client code requirement,” and warned users to keep fees conservative to avoid transactions getting stuck during fee spikes. MARA said it will not charge an extra surcharge; users still pay normal Bitcoin network fees.

The Coldcard firmware error, traced to March 2021, caused affected devices to fall back from the hardware random number generator to a weaker software process when creating 24-word seed phrases. Researchers reported that the mistake cut effective entropy to about 40 bits on older models and about 72 bits on newer affected models, reducing the number of possible seed combinations and making brute-force attacks feasible for adversaries with sufficient computing power.

Attackers moved funds soon after the flaw became public. Early tallies showed roughly 594 BTC, about $38 million at the time, drained from around 500 addresses. Later estimates rose to roughly 1,816 BTC, near $116 million, taken from more than 5,200 wallets. Coldcard released a firmware patch that prevents new wallets from inheriting the error, but the patch does not change seed phrases already generated under the faulty code. Owners who created wallets on affected devices must move coins to new, secure keys.

Broadcasting a migration transaction on the public mempool exposes its inputs, outputs and spending conditions. An attacker who already holds or can guess a weak private key can use Bitcoin’s Replace-by-Fee feature to submit a conflicting transaction with a higher fee and have miners prioritize the competing transaction, potentially taking the funds before the original transaction confirms.

Slipstream reduces that exposure by keeping migration transactions out of the public mempool until MARA mines a block that includes them. Transactions submitted through Slipstream are visible only to MARA’s pool while queued, preventing network monitors from seeing spending details and crafting competing replacement transactions.

The service depends on MARA’s mining performance. On Aug. 4, MARA’s pool accounted for about 5.37% of Bitcoin’s total hashpower, so confirmation timing for Slipstream submissions depends on how quickly MARA finds a block. MARA advised setting competitive fees while avoiding extremely low or excessively high fees that could leave transactions queued if fee rates spike.

Slipstream first launched on Feb. 22, 2024, to help large or unusual transactions that some nodes decline to relay. Access sometimes required a client code during peak demand or maintenance; the code requirement has been dropped. Security researchers and wallet developers have recommended private submission paths like Slipstream as an option for moving coins generated under the flawed Coldcard firmware. The community is awaiting more detailed guidance from Coldcard on which firmware versions and device serial ranges were affected and updated estimates of losses as more compromised addresses are identified.