Large-scale Coldcard compromise (1596 BTC stolen so far)

[bitmover]

The question now remains, how will the victims prove that their bitcoin was stolen?
Since there is no kyc to be able to identify owners?

This is what signing a message was created for.

But, other people could have the keys as well.

They could have saved the receipt of their coldcard together with the signed message.

[suzanne5223]

I imagine there is likely more than one class action being cooked up.

Would they have deep enough pockets for this? I can imagine they spent a lot of money on marketing, sales and the actual product, while they didn't sell that many devices. So if all buyers want their money back, they don't have that amount. If the victims want their losses compensated, they won't have that kind of money it either.

I wonder if they will be able to find the users who now hold those 1500 btc. One small mistake when spending, even in a kyc free exchange (like an ip leak),  might expose their identities

Tell will tell if someone from coldcard is involved

That ColdCard CTO who made an anonymous account and he was talking to the account - HIMSELF, in Github is already a red flag in my opinion.

This issue should definitely be investigated. Users have lost their savings because of developer-INCOMPETENCE or developers being BAD ACTORS.

Yes, he's a red flag, but we can talk about the unprofessional service provided by the Coldcard team and not talk about people who spent weeks assisting Bitcoin holders who were affected by the Coldcard vulnerability by helping them to transfer their funds to safety, with the estimation of tens of millions of dollars worth of BTC protected during the period the Coldcard vulnerability occurred.
https://x.com/BitcoinNewsCom/status/2092703792944808228

[ryzaadit]

This is what signing a message was created for.
But, other people could have the keys as well.
-snip

How about the signed message from the previous transaction before the sweeps?

Pretty sure the majority of the addresses are dormant addresses before they got sweeps, people are usually send their BTC after they got the hardware wallet > created the seed & wallet  > then send the BTC > and leave it for such a long time.

They fill it the fund with either sending from another address or buying it from the exchange.

[retreat]

Just reading this on reddit. It seems the hacker is trying to move the money but still not smart enough to do that.


https://www.reddit.com/r/coldcard/comments/1vy9ekz/coldcard_hacker_discovered_mixers_and_is_doing_a/

I bet that hacker is scratching his head right now thinking of a way to get the money out without being traced.

[Wind_FURY]

Just reading this on reddit. It seems the hacker is trying to move the money but still not smart enough to do that.


https://www.reddit.com/r/coldcard/comments/1vy9ekz/coldcard_hacker_discovered_mixers_and_is_doing_a/

I bet that hacker is scratching his head right now thinking of a way to get the money out without being traced.

The "hacker" should have used ThorChain, and swapped the stolen Bitcoin to Monero starting in Day Zero and continued that when more Bitcoin is stolen.

But the hacker's current move is good to test how those mixers are good in obfuscation. For that purpose, they should probably test CoinJoin too.

[joker_josue]

The "hacker" should have used ThorChain, and swapped the stolen Bitcoin to Monero starting in Day Zero and continued that when more Bitcoin is stolen.

But the hacker's current move is good to test how those mixers are good in obfuscation. For that purpose, they should probably test CoinJoin too.

For that to happen, he needed to have planned for the possibility of acquiring that large amount of Bitcoin.

He probably didn't expect to be so successful, and the fact that he was discovered just a few hours later didn't even give him time to think of a solution.

That's a lot of money; he's going to have to use many, many tools to "launder" all that cash, especially now that there are a thousand eyes on him.

[Pmalek]

How about the signed message from the previous transaction before the sweeps?

Pretty sure the majority of the addresses are dormant addresses before they got sweeps, people are usually send their BTC after they got the hardware wallet > created the seed & wallet  > then send the BTC > and leave it for such a long time.

They fill it the fund with either sending from another address or buying it from the exchange.

That's a big if. Bitcoins exchange hands and ownership all the time. Prior to sending the coins to a Coldcard, they could have belonged to another person - the seller who sold the Coldcard owner their coins. They could have been acquired in a P2P trade where there are no records that can be used as proof. The coins could have been bought at an exchange, which has in the meantime shut down. But even if it hasn't shut down, you can't sign a message from such an address because the service owns the keys, not the end user.

Only some victims would be able to acquire the needed digital proof.

[mabji1]

https://www.blockchain.com/explorer/addresses/btc/bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r

So intelligent, yet so foolish 

[bitmover]

The "hacker" should have used ThorChain, and swapped the stolen Bitcoin to Monero starting in Day Zero and continued that when more Bitcoin is stolen.

But the hacker's current move is good to test how those mixers are good in obfuscation. For that purpose, they should probably test CoinJoin too.

Thorchain website isn't working right now, and no monero support


I am not sure how you can access it without the front end , but it should be possible. Actually, using the front end would be quite dangerous for him because it could save logs.

He probably didn't expect to be so successful, and the fact that he was discovered just a few hours later didn't even give him time to think of a solution.

That's a lot of money; he's going to have to use many, many tools to "launder" all that cash, especially now that there are a thousand eyes on him.

He could have stealing 5-10 bitcoin per month for a few months, nobody would have noticed and blamed coldcard.

[bitbollo]

Probably this was already happening since there are severeal online claims of users that have their btc lost using this hardware.

... nobody would have noticed and blamed coldcard.

it could be not excluded that they have just collected the majority of the keys before claiming the whole attack.
it worth mention that there are more "patterns" of attackers, probably there isn't only one cluster/user.

[I read some retard comment about "white hacker" trying to using the same exploit for "save bitcoin from the black hacker" ]

The amount stolen doesn't look so basic or easy to hide.
Probably we are just not ready to understand and assimilate this issue...
The first has been to underestimate the risk on rely on third parties.
The second has been completely voided the concept of trust - I trust another entity making hardwares and not just my self using a tutorial
Third, if bitcoin would become what we are expecting, it's clear that any amount could become impressively precious.
Forth (worst point) this has been used as wrench for attacking self custody and continue to blame on people that want have their sovereignity managing bitcoin in totally autonomy.

[ultrloa]

Just reading this on reddit. It seems the hacker is trying to move the money but still not smart enough to do that.


https://www.reddit.com/r/coldcard/comments/1vy9ekz/coldcard_hacker_discovered_mixers_and_is_doing_a/

I bet that hacker is scratching his head right now thinking of a way to get the money out without being traced.

They already done this before.

Blockchain security firm CertiK has detected that approximately 64 Bitcoin (worth $4.17 million)** and **200 Ether (worth $380,000) linked to the Coldcard attack were transferred to cryptocurrency mixing protocols this week .

https://www.coinainews.com/2026/08/coldcard-hackers-move-45-million-to.html

But they are been flagged now and this is the reason why they are stuck then struggle to pull out their stolen funds. They are provably afraid to move those stuck funds, because by the time they do it for sure they might get tracked by entities investigating this case.