MARA Slips into Emergency Mode as Coldcard Wallets Flooded with Attacks

MARA Holdings, the Nasdaq-listed bitcoin miner and AI infrastructure provider, has made its Slipstream service available to the public. This service allows users to send Bitcoin transactions directly to MARA's mining pool instead of broadcasting them on the public network.

Slipstream skips the shared waiting room called the mempool, where every node can see a transaction before it gets confirmed into a block. Users submit signed transactions to MARA, and they remain hidden until MARA mines a block with them inside.

The timing of this move is not a coincidence. A serious flaw in Coldcard hardware wallets was disclosed at the end of July, affecting models from March 2021. This mistake reduced the effective randomness of wallet seed phrases, making it easier for attackers to guess and unlock the wallets.

Attackers quickly moved to drain compromised wallets, with estimates suggesting around $70 million to $88 million has been stolen so far. For those using multi-signature setups, moving funds publicly creates its own risk, as an attacker can spot the transaction and use Replace-by-Fee (RBF) to jump the line and steal the funds.

MARA's Slipstream removes this window of exposure by keeping transactions hidden until MARA has mined them into a confirmed block. However, users still carry the trust and timing risk, as they depend on MARA finding blocks.