Coldcard hardware wallets built from 2021 firmware generated seeds with a bug that cut real entropy to about 40 bits (Mk3) or 72 bits (Mk4, Mk5, Q). Attackers recomputed keys offline and have drained roughly 1,800 BTC (about 115 million dollars) from more than 5,200 wallets, some kept in bank vaults. If your business holds bitcoin on a Coldcard, move funds to a wallet generated on a verified device or new seed, and do not assume offline storage alone is safe. Otherwise this is background only: it is a crypto-specific risk and does not change Thai tax, cost or lending planning.