Block 961,632 arrived with only 48 of the preceding 1,831 blocks carrying the BIP-110 signal — 2.62% of the two-week window against a 55% threshold required for lock-in — ending the proposal's activation path under the current ruleset without the threshold ever approaching. OCEAN Pool was the only major mining operation to signal by default; Foundry USA, despite running a hashrate-weighted miner vote with non-responses counting as No through August 8, did not flip its signaling, and Antpool, ViaBTC, and F2Pool held out through the close. BIP-110, authored by developer Dathon Ohm, would have restricted most transaction outputs to 34 bytes, OP_RETURN to 83 bytes, and arbitrary data pushes to 256 bytes for one year, targeting Ordinal inscriptions, BRC-20 payloads, and similar non-payment data. Luke Dashjr said following the window's close that a proof-of-work algorithm change was the only remaining path if the proposal's goals were to be met outside the standard BIP activation process.

Four waves of theft followed the initial July 30 sweep: Galaxy Research's running tally reached 1,816 BTC — approximately $116 million at current prices — drained from more than 5,200 addresses, up from the 474 wallets and 594 BTC reported when the first sweep was detected. The vulnerability, introduced in firmware version 4.0.0 in March 2021, caused affected Coldcard devices to substitute MicroPython's software random number generator for the dedicated hardware entropy source during seed creation, collapsing key entropy from 128 bits to as little as 40 bits on older models; seeds derived partly from predictable parameters — device serial numbers and internal clock values — gave the attacker a precomputable keyspace scannable against the blockchain at scale. Affected models span Mk3 devices on firmware 4.0.0 through 5.0.3 and Mk4, Mk5, and Q devices on firmware below 5.6.0; wallets created using the dice-roll entropy option from initial setup appear unaffected. Coinkite released patched firmware and urged all potentially affected users to generate new seeds using a minimum of 50 dice rolls, then move funds to addresses derived from the new seed before the attacker scans the remaining vulnerable keyspace.