MARA Launches Public Access to Slipstream as Coldcard Security Crisis Unfolds

TL;DR:

• MARA enabled public and permissionless access to its Slipstream direct transaction submission service.
• Galaxy Research analysts reported the theft of 1,082.65 BTC across 1,196 addresses associated with Coldcard devices on July 30, 2026.
• The service allows processing transactions directly with miners without exposing operations in the public Bitcoin network mempool.

---

Mining company MARA Holdings enabled public access to its MARA Slipstream platform without the need for client software in early August 2026. The move is presented as a technical alternative for users affected by the recent security flaw in Coldcard wallets to execute the migration of their assets directly to miners.

🚨@MARA Slipstream is now available as a permissionless public good with no client code requirement.

Please be careful and conservative with fees to avoid transactions getting stuck in the Slipstream mempool in the event that competitive rates spike.

For the foreseeable…

— MARA Foundation (@MARAFoundation_) August 3, 2026

Protecting Funds Against the Coldcard Vulnerability

The background to this update stems from the security incident identified in late July 2026. According to data from Galaxy Research, an attacker drained a total of 1,082.65 BTC distributed across 1,196 Bitcoin addresses within a 41-minute period on July 30, 2026.

The breach affected Coldcard Mk3 devices running firmware versions released between March 2021 and mid-2026. Technical documentation from Coinkite indicates that the fault originated in the random number generator generation for recovery seed phrases, which allowed for the offline recreation of private keys.

When users attempt to withdraw funds from vulnerable multisig setups, public keys are exposed to the network. Security analyses suggest that attackers can monitor the mempool to detect these operations and execute Replace-By-Fee (RBF) attacks to front-run block confirmation.

The Slipstream service operates as a direct data transmission channel to MARA’s mining infrastructure. Official information from the company states that transactions submitted through this channel do not enter public mempool nodes prior to their inclusion in a confirmed block.

Additionally, custody integrators such as Unchained incorporated the option to send operations via the Slipstream API directly from their platforms. According to reports from Unchained, this measure is critical for clients managing vaults with multiple keys generated on affected Coldcard devices.

Regarding operational fees, the public service does not charge additional processing costs beyond standard fees required by the Bitcoin network. MARA’s published recommendation emphasizes using conservative network fees to prevent delays or blocks in transaction inclusion.

Industry companies continue to coordinate outreach efforts to urge users to update their hardware wallet device firmware. According to Coinkite’s patch schedule, the fixed firmware version has been available for download on its official channels since July 31, 2026.