Large-scale Coldcard compromise (1596 BTC stolen so far)

[bitmover]

The question now remains, how will the victims prove that their bitcoin was stolen?
Since there is no kyc to be able to identify owners?

This is what signing a message was created for.

But, other people could have the keys as well.

They could have saved the receipt of their coldcard together with the signed message.

[suzanne5223]

I imagine there is likely more than one class action being cooked up.

Would they have deep enough pockets for this? I can imagine they spent a lot of money on marketing, sales and the actual product, while they didn't sell that many devices. So if all buyers want their money back, they don't have that amount. If the victims want their losses compensated, they won't have that kind of money it either.

I wonder if they will be able to find the users who now hold those 1500 btc. One small mistake when spending, even in a kyc free exchange (like an ip leak),  might expose their identities

Tell will tell if someone from coldcard is involved

That ColdCard CTO who made an anonymous account and he was talking to the account - HIMSELF, in Github is already a red flag in my opinion.

This issue should definitely be investigated. Users have lost their savings because of developer-INCOMPETENCE or developers being BAD ACTORS.

Yes, he's a red flag, but we can talk about the unprofessional service provided by the Coldcard team and not talk about people who spent weeks assisting Bitcoin holders who were affected by the Coldcard vulnerability by helping them to transfer their funds to safety, with the estimation of tens of millions of dollars worth of BTC protected during the period the Coldcard vulnerability occurred.
https://x.com/BitcoinNewsCom/status/2092703792944808228

[ryzaadit]

This is what signing a message was created for.
But, other people could have the keys as well.
-snip

How about the signed message from the previous transaction before the sweeps?

Pretty sure the majority of the addresses are dormant addresses before they got sweeps, people are usually send their BTC after they got the hardware wallet > created the seed & wallet  > then send the BTC > and leave it for such a long time.

They fill it the fund with either sending from another address or buying it from the exchange.

[retreat]

Just reading this on reddit. It seems the hacker is trying to move the money but still not smart enough to do that.


https://www.reddit.com/r/coldcard/comments/1vy9ekz/coldcard_hacker_discovered_mixers_and_is_doing_a/

I bet that hacker is scratching his head right now thinking of a way to get the money out without being traced.

[Wind_FURY]

Just reading this on reddit. It seems the hacker is trying to move the money but still not smart enough to do that.


https://www.reddit.com/r/coldcard/comments/1vy9ekz/coldcard_hacker_discovered_mixers_and_is_doing_a/

I bet that hacker is scratching his head right now thinking of a way to get the money out without being traced.

The "hacker" should have used ThorChain, and swapped the stolen Bitcoin to Monero starting in Day Zero and continued that when more Bitcoin is stolen.

But the hacker's current move is good to test how those mixers are good in obfuscation. For that purpose, they should probably test CoinJoin too.

[joker_josue]

The "hacker" should have used ThorChain, and swapped the stolen Bitcoin to Monero starting in Day Zero and continued that when more Bitcoin is stolen.

But the hacker's current move is good to test how those mixers are good in obfuscation. For that purpose, they should probably test CoinJoin too.

For that to happen, he needed to have planned for the possibility of acquiring that large amount of Bitcoin.

He probably didn't expect to be so successful, and the fact that he was discovered just a few hours later didn't even give him time to think of a solution.

That's a lot of money; he's going to have to use many, many tools to "launder" all that cash, especially now that there are a thousand eyes on him.

[Pmalek]

How about the signed message from the previous transaction before the sweeps?

Pretty sure the majority of the addresses are dormant addresses before they got sweeps, people are usually send their BTC after they got the hardware wallet > created the seed & wallet  > then send the BTC > and leave it for such a long time.

They fill it the fund with either sending from another address or buying it from the exchange.

That's a big if. Bitcoins exchange hands and ownership all the time. Prior to sending the coins to a Coldcard, they could have belonged to another person - the seller who sold the Coldcard owner their coins. They could have been acquired in a P2P trade where there are no records that can be used as proof. The coins could have been bought at an exchange, which has in the meantime shut down. But even if it hasn't shut down, you can't sign a message from such an address because the service owns the keys, not the end user.

Only some victims would be able to acquire the needed digital proof.

[mabji1]

https://www.blockchain.com/explorer/addresses/btc/bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r

So intelligent, yet so foolish 

[bitmover]

The "hacker" should have used ThorChain, and swapped the stolen Bitcoin to Monero starting in Day Zero and continued that when more Bitcoin is stolen.

But the hacker's current move is good to test how those mixers are good in obfuscation. For that purpose, they should probably test CoinJoin too.

Thorchain website isn't working right now, and no monero support


I am not sure how you can access it without the front end , but it should be possible. Actually, using the front end would be quite dangerous for him because it could save logs.

He probably didn't expect to be so successful, and the fact that he was discovered just a few hours later didn't even give him time to think of a solution.

That's a lot of money; he's going to have to use many, many tools to "launder" all that cash, especially now that there are a thousand eyes on him.

He could have stealing 5-10 bitcoin per month for a few months, nobody would have noticed and blamed coldcard.

[bitbollo]

Probably this was already happening since there are severeal online claims of users that have their btc lost using this hardware.

... nobody would have noticed and blamed coldcard.

it could be not excluded that they have just collected the majority of the keys before claiming the whole attack.
it worth mention that there are more "patterns" of attackers, probably there isn't only one cluster/user.

[I read some retard comment about "white hacker" trying to using the same exploit for "save bitcoin from the black hacker" ]

The amount stolen doesn't look so basic or easy to hide.
Probably we are just not ready to understand and assimilate this issue...
The first has been to underestimate the risk on rely on third parties.
The second has been completely voided the concept of trust - I trust another entity making hardwares and not just my self using a tutorial
Third, if bitcoin would become what we are expecting, it's clear that any amount could become impressively precious.
Forth (worst point) this has been used as wrench for attacking self custody and continue to blame on people that want have their sovereignity managing bitcoin in totally autonomy.

[ultrloa]

Just reading this on reddit. It seems the hacker is trying to move the money but still not smart enough to do that.


https://www.reddit.com/r/coldcard/comments/1vy9ekz/coldcard_hacker_discovered_mixers_and_is_doing_a/

I bet that hacker is scratching his head right now thinking of a way to get the money out without being traced.

They already done this before.

Blockchain security firm CertiK has detected that approximately 64 Bitcoin (worth $4.17 million)** and **200 Ether (worth $380,000) linked to the Coldcard attack were transferred to cryptocurrency mixing protocols this week .

https://www.coinainews.com/2026/08/coldcard-hackers-move-45-million-to.html

But they are been flagged now and this is the reason why they are stuck then struggle to pull out their stolen funds. They are provably afraid to move those stuck funds, because by the time they do it for sure they might get tracked by entities investigating this case.

[Forsyth Jones]

Probably this was already happening since there are severeal online claims of users that have their btc lost using this hardware.

... nobody would have noticed and blamed coldcard.

it could be not excluded that they have just collected the majority of the keys before claiming the whole attack.
it worth mention that there are more "patterns" of attackers, probably there isn't only one cluster/user.

[I read some retard comment about "white hacker" trying to using the same exploit for "save bitcoin from the black hacker" ]

The amount stolen doesn't look so basic or easy to hide.
Probably we are just not ready to understand and assimilate this issue...
The first has been to underestimate the risk on rely on third parties.
The second has been completely voided the concept of trust - I trust another entity making hardwares and not just my self using a tutorial
Third, if bitcoin would become what we are expecting, it's clear that any amount could become impressively precious.
Forth (worst point) this has been used as wrench for attacking self custody and continue to blame on people that want have their sovereignity managing bitcoin in totally autonomy.

What madness, this case is likely to drag on for months/years and become a new ghost like the MtGox hack (with the difference that the money is in the hands of the criminal and not the police or government).

A sad story for self-defense, but let it serve as a lesson: use a passphrase when using hardware wallets and prefer truly open source HW or software wallets, don't fully trust the wallet generator, verify it, and if you don't know how to verify the code, at least use a passphrase and BIP-85, knowing such things is a matter of survival.

[PrivacyG]

I imagine the hacker sweating all over every time they wake up, still trying to find out the best way to do this.

But at this significant value, there is no thing they can do.  They would have to change their life significantly to be able to enjoy even some of that stolen money.  100,000 Dollars would have been a lot easier to manage.  For this much however, you better find and pay Ruja Ignatova a visit because that is your life now.  Living in the sewers with all those Billions, working with the mafia who may or may not cut your head off by the time they find out how much you are worth.

Congratulations!

Considering there is clearly zero remorse over what they have done and even the post theft moves seem to be stupid.  I suppose they have already been stupid enough to drop bread crumbs here and there.  Such as leaving their job in the same week they stole the Bitcoin, becoming dubious interacting with others et cetera.  I can really not imagine how some body can do this with out dropping bread crumbs.

I know what I would have done if I was this evil.  But just like criminals who plan every thing out perfectly and then fail miserably by leaving a bucket of crumbs at the door for the investigators to find, this one is laughably stupid enough to probably either fall and get caught or simply chicken out.

In fact.  I am hoping they end up reading this sweating all over again.  If Artificial Intelligence helped them find the bug, by the way it looks it is also Chat GPT telling them how to hide their Bitcoin.

[fillippone]

Just reading this on reddit. It seems the hacker is trying to move the money but still not smart enough to do that.


https://www.reddit.com/r/coldcard/comments/1vy9ekz/coldcard_hacker_discovered_mixers_and_is_doing_a/

I bet that hacker is scratching his head right now thinking of a way to get the money out without being traced.

The point is that if you make an error, you are doing it forever.
He's testing with 64 BTC and learning what he should do.
Of course, he's good at prompting AI, not at privacy techniques on the Bitcoin blockchain.
But he will get there, soon, with 64 BTC, and later with the rest.
That little bastard.

[Stalker22]

~

This is all pure speculation.  There is nothing to back up the idea that an attacker of this level is sitting around sweating, or taking advice from ChatGPT.  On what basis do you make such assumptions?

[ryzaadit]

-snip-
Only some victims would be able to acquire the needed digital proof.

Yes agree with you, especially from someone who is sending from his other personal wallet. I always thought the transition for someone to store their bitcoin could be from exchange > self-custody > hardware wallet. That's why I always thought that a previous transaction could be used as PoA of the coins.

The "hacker" should have used ThorChain, and swapped the stolen Bitcoin to Monero starting in Day Zero and continued that when more Bitcoin is stolen.
But the hacker's current move is good to test how those mixers are good in obfuscation. For that purpose, they should probably test CoinJoin too.

The problem is liquidity, there is no service that can handle those typical funds with such a large fund. The best way for him should just not do anything for the next 1-2 years until the topics a little bit of room, and he can try to learn the best way to mix the coins. Right now maybe he can do is Coinjoin & Peel-Chain transaction, IMO he just too fast to do these.


Hopefully with these small errors, we can catch him.

[Meuserna]

Probably this was already happening since there are severeal online claims of users that have their btc lost using this hardware.

... nobody would have noticed and blamed coldcard.

it could be not excluded that they have just collected the majority of the keys before claiming the whole attack.

That is exactly what I believe happened. And it's what I believe will happen again when Ledger's firmware gets hacked, because Ledger's firmware contains a key extraction API.

I said this, two years ago:

When Ledger's key extraction code gets hacked, the hackers aren't going to drain wallets right away because they're not going to want to let Ledger know they've been hacked.  The hackers are going to want to keep the exploit a secret while they steal as many keys as they can, because the moment Ledger finds out they've been hacked, Ledger can start working on a patch, which would stop hackers from stealing more keys.

Reread that paragraph if you didn't understand what I just said.

Hackers won't want Ledger to patch the buggy code.  Hackers will want to steal as many users keys as possible before draining wallets, because when they start draining wallets Ledger will find out they've been hacked.

When Ledger gets hacked, or when YOU get hacked, you're not going to know.  In fact, there's no way for you to know if hackers already have your keys.  I doubt that they do, but since there's no way to know, it means you're not safe using Ledger hardware or software, and you're not safe using a seed that has ever been used on Ledger hardware or software.

I won't be surprised at all if we eventually find out the ColdCard thief found the exploit months ago and was building up a list of wallets to hit.

And I firmly believe Ledger's key extraction scheme is a disaster waiting to happen. It'll go down the same way, except in Ledger's case, it'll be the devices themselves that get accessed. And when it happens, finally, people will realize it's stooooopid to think you can safely secure Bitcoin on a hardware wallet that can be accessed over the internet.