Large-scale Coldcard compromise (1360.23 BTC stolen so far)

[BobbysTransactions]

Yes, but is this a credible error? Why would the developer think "let me use #ifndef rather than #if"?

Yes, it's a common error particularly when working across different codebases with different styles.  In the case of coldcard there were three relevant codebases: micropython, libngu, and the coldcard codebase itself.

Likelyhood with be greater with less experience with C but this is the sort of error that even the most experienced C developers can make:

Both styles-- value and defineness checking-- are commonly used for configuration and you can mix them up.  *Usually* the result of doing so is something that is obviously wrong and gets caught right away.  But because of the PRNG fallback in micropython the bad behavior was difficult to detect because it would look and act like real randomness and pass most tests you might throw at it.

The more I think about it I'm not so sure. Disabling the build flag for the TRNG and mangling the sense check with ~ifndef is a double error. Hard at this stage to dismiss the possibility that this was done on purpose and made to look like an oversight.

[vapourminer]

But my concern is what are people doing here?  If anyone says that their wallet has been drained off in the 4th wave, what was he doing before? Why can't everyone move their funds out immediately? It's not a centralised exchange or something where they can put a halt on your withdrawals ?

Not all people are aware of what's happening with Coldcard wallets.
Many users probably generated a wallet on Coldcard, sent their funds to it, and assumed they would be 100% safe.

You can't expect all Bitcoin investors to stay up to date with every new development. The incident only started three days ago.

plus some folks make cold storage deliberately time consuming to access to protect against duress or impulsiveness. so it may well take several days to get to the seed or wallet to xfer the coins out.

[bitmover]

plus some folks make cold storage deliberately time consuming to access to protect against duress or impulsiveness. so it may well take several days to get to the seed or wallet to xfer the coins out.

Yeah, cold wallets can be used for trading but lots of people dont touch them for months.

Some people might be traveling and without access to the wallet. This happens to me a lot.
This is a very sad and desperate situation for so many people...

I wonder what will the hacker do with all those coins. Are they north Korean? Why would someone want so much money? He could have drained just a few hundread btc if it is just a small group.

[DaveF]

And the scammers being scamming.






The schedule link looks like it wants to install something.

h t t p s : / / b o o k . c o i n k i t e a d v i s o r y . c o m /

reported if others can to that would be great.



Domain Name: coldcardblog.org
Registry Domain ID: REDACTED
Registrar WHOIS Server: whois.squarespace.domains
Registrar URL: https://domains.squarespace.com
Updated Date: 2026-08-03T11:03:53Z
Creation Date: 2026-08-03T10:56:49Z
Registry Expiry Date: 2027-08-03T10:56:49Z
Registrar: Squarespace Domains LLC
Registrar IANA ID: 3827
Registrar Abuse Contact Email: abuse-complaints@squarespace.com
Registrar Abuse Contact Phone: +1.6466935324
Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: addPeriod https://icann.org/epp#addPeriod
Name Server: nsc1.squarespacedns.com
Name Server: nsc2.squarespacedns.com
Name Server: nsc3.squarespacedns.com
Name Server: nsc4.squarespacedns.com
DNSSEC: signedDelegation
URL of the ICANN Whois Inaccuracy Complaint Form: https://icann.org/wicf/
>>> Last update of WHOIS database: 2026-08-03T16:31:56Z <<<

[philipma1957]

plus some folks make cold storage deliberately time consuming to access to protect against duress or impulsiveness. so it may well take several days to get to the seed or wallet to xfer the coins out.

Yeah, cold wallets can be used for trading but lots of people dont touch them for months.

Some people might be traveling and without access to the wallet. This happens to me a lot.
This is a very sad and desperate situation for so many people...

I wonder what will the hacker do with all those coins. Are they north Korean? Why would someone want so much money? He could have drained just a few hundread btc if it is just a small group.

Lots of what or whom the hacker could be.

If it is one guy he should have done 1 wallet with 2 or 3 coins. Then practiced mixing the heck out of it.

He likely would not have been detected and could have grabbed a few btc every 4 or 5 months.

Not so sure that it was a loner.

Time will unfold and we may get more details in the next few months.

Here is hoping it is not a big crew looking to hit a second company soon.

Many fear ledger and its recovery program.

My advice is have a few setups and add strong passphrases

[bitmover]

My advice is have a few setups and add strong passphrases

This is basically mandatory now..

I have a second wallet without a passphrase. I will move the funds to a new wallet with passphrase during this week.

But I have many coins, many addresses, many derivation paths. It will take some time...

[MicroGuy]

What's wrong with a laminated paper wallet rolled up in a sealed PVC pipe filled with rice and buried in backyard?

[jayhex]

also; you know they're just going to sell all this stolen btc on the 7th or whenever bip110 activates. mfers

[EstherBtc]

Found this on https://x.com/BitcoinNewsCom/status/2084273394229362780