BTCPay placed bounty on wrongdoers

[5W-KILO]

You can tell that this people mean business



The better the bounty reward the probability of finding the culprits.
Someone somewhere knows something.

If the price is very good it's possible they will find something.
What do you guys think?

I was actually expecting something like this from ColdCard too.

[OmegaStarScream]

Good initiative, let's hope they manage to find find something.

As for ColdCard, then I would imagine the amount is too big for them to offer a bounty on it. Coldcard cannot be compared to Trezor or Ledger in terms of revenue. They're much smaller than that.

The second problem is that probably nothing is going to save them. People already hate them, I highly doubt they would ever sell another hardware wallet regardless of the outcome of this.

But even if they did offer a bounty, and the funds were returned... they will still have victims pissed at them, due to how long (and extremly difficult more than anything else) the process of returning funds would be.

[Oshosondy]

So has the bitcoin been recovered despite the bounty? At least let the money be recovered before recommending it to another company.

It is just over for Coldcard.

I was actually expecting something like this from ColdCard too.

Those that their coins was stolen can offer the bounty instead. Coldcard market share among the crypto hardware wallets is 1% which is very small.

[Majestic-milf]

So has the bitcoin been recovered despite the bounty? At least let the money be recovered before recommending it to another company.

It is just over for Coldcard.

Maybe it was done as incentive to make the process work faster because there's nothing as motivating as money. The question is won't this pattern be opening them up for more problems in the future?

Those that their coins was stolen can offer the bounty instead. Coldcard market share among the crypto hardware wallets is 1% which is very small.

Really? I feel they'd be too pained too even explore that option.

[EL MOHA]

So has the bitcoin been recovered despite the bounty? At least let the money be recovered before recommending it to another company.

I think they are looking to following similar directions as other platforms had done in the past, a recent example is the bybit hack. Bybit placed a bounty on the recovery of the assets which was around 10% of the total recovered amount and within few days there was a track of around $40 million by some on-chain analysts. But until now almost half of the stolen assets still is yet to be recovered or tracked. Even though exchanges are actually helping to freeze the address linking to this hacked addresses

It is just over for Coldcard.

Those that their coins was stolen can offer the bounty instead. Coldcard market share among the crypto hardware wallets is 1% which is very small.

Yes I believe too that it is over for coldcard even if they get to recover anything they won’t be trusted again, there case is just similar to MtGox and FTX in terms of trust even if there is recovery no one is going back there.

The owners cannot come out to place bounty on it because it has to be an unanimous decision and do we even know the victims only coldcard can place the bounty themselves. But they are not doing it, if not most victims would be glad to lose just 10% of their asset to the bounty if they can help to recover their assets

[SquirrelJulietGarden]

Yes I believe too that it is over for coldcard even if they get to recover anything they won’t be trusted again, there case is just similar to MtGox and FTX in terms of trust even if there is recovery no one is going back there.

It's over for this hardware wallet because their products are different than centralized exchanges and they don't have too big revenue with time. With good exchanges like Binance, Bybit for example, they can continue their operations, and use their business revenues to pay users as compensations with time. With Coldcard, it's impossible task for them and no compensation for users mean they're done with their business.

The owners cannot come out to place bounty on it because it has to be an unanimous decision and do we even know the victims only coldcard can place the bounty themselves. But they are not doing it, if not most victims would be glad to lose just 10% of their asset to the bounty if they can help to recover their assets

Does the Coldcard founder actually have too big fund for bounty?
I don't believe that he has enough money for that and he only can hope for support from police, governments and Interpol but chances to get hacked bitcoins back is almost zero.

Like Bybit identified Lazarus as hackers on their exchange but many months later they have still been unable to get money back.

[Oshosondy]

I think they are looking to following similar directions as other platforms had done in the past, a recent example is the bybit hack. Bybit placed a bounty on the recovery of the assets which was around 10% of the total recovered amount and within few days there was a track of around $40 million by some on-chain analysts. But until now almost half of the stolen assets still is yet to be recovered or tracked. Even though exchanges are actually helping to freeze the address linking to this hacked addresses

Prevention is better, but most of them do not know they will be hacked until it happened. According to what I have read about the Bybit breach was that most of the coins were later hard to trace, Bybit was unable to recover more than 90% of the ether that was stolen by the hackers. The hackers that stole the ethereum were smart.

[Mrbluntzy]

This is a good initiative by BTCpay, it's the first time I'm learning about a Bitcoin focused  company bringing a bounty like this public, some company usually prefers to keep it internal because they believe that public bounty would reveal investigation details and lead to some persons coming up with false reports and that's what they try to avoid. If Coldcard is doing same bounty to investigate the theft, they might not bring it public until the investigation is completed and the aimed result is being achieved.  

I don't expect that Coldcard will just sit down and do nothing about this hack, they probably might have set up investigation, this hack have already destroyed their reputation, so the least they could do is to try to fix this, if at all they can.

[Dunamisx]

You can tell that this people mean business



The better the bounty reward the probability of finding the culprits.
Someone somewhere knows something.

If the price is very good it's possible they will find something.
What do you guys think?

I was actually expecting something like this from ColdCard too.

I may not be really convinced that despite the bounty placed, it is still under probability that even if discovered they may not come to the public and declare what has been seen, come to think of it from another perspective, whereby there is an insider clue that tend to pretend they don't know anything concerning this and awaiting for the reward after the discovery, let's see how the game goes with the bounty placed.

[ANSEL_2.0]

Good initiative, let's hope they manage to find find something.

As for ColdCard, then I would imagine the amount is too big for them to offer a bounty on it. Coldcard cannot be compared to Trezor or Ledger in terms of revenue. They're much smaller than that.

The second problem is that probably nothing is going to save them. People already hate them, I highly doubt they would ever sell another hardware wallet regardless of the outcome of this.

But even if they did offer a bounty, and the funds were returned... they will still have victims pissed at them, due to how long (and extremly difficult more than anything else) the process of returning funds would be.

So ColdCard was just some junior running the hardware wallet game? no wonder this happened, i am still surprised why many people are using this less popular hardware wallet, or are they just very good at marketing? my friend said he could remember some youtubers telling their followers to buy ColdCard wallet, i guess they did it for referral money......

[Danish Ali]

The better the bounty reward the probability of finding the culprits.

Someone somewhere knows something.

A good bounty can definitely increase the chances of getting information, there are always those that know, but don't say until they perceive a motive to say.

But the toughest portion is determining whether or not the information is genuine or the one trying to gain an easy buck. In this case, there can be a number of bogus reports.

I was actually expecting something like this from ColdCard too.

This happens following a security incident and I believe more companies will want to consider this in their future. It will not fix all the problems but it will definitely contribute in finding the cause, and at the very least make people feel that the team is taking the matter seriously as well.

[Slow death]

You can tell that this people mean business



The better the bounty reward the probability of finding the culprits.
Someone somewhere knows something.

If the price is very good it's possible they will find something.
What do you guys think?

I was actually expecting something like this from ColdCard too.

Unfortunately, we are in an era where even hackers are controlled by governments; not all of them, of course, but some are. I say this because last year, in the Bybit case, where hackers stole US$1.4 billion in ETH, the FBI accused hackers working for North Korea.

In the DMM Bitcoin exchange case, which happened in 2024 and hackers stole US$308 million in Bitcoin, investigations revealed it was a North Korean hacker group. The KuCoin case, where US$281 million in cryptocurrencies were stolen, also points to North Korean hackers, as can be seen in this article:

https://crystalintelligence.com/investigations/the-10-biggest-crypto-hacks-in-history/

I'm posting this to say the following: even if a billion-dollar reward is offered for finding those responsible for this misfortune affecting so many people, it might still not be possible to punish the culprits. Because if they are North Korean hackers...

no other government will catch them in North Korea, and I highly doubt that North Korean hackers would act without orders from the North Korean government. They would probably quickly send everything they stole to the Korean government if they are Korean hackers behind this crime.

[Franctoshi]

You can tell that this people mean business



The better the bounty reward the probability of finding the culprits.
Someone somewhere knows something.

If the price is very good it's possible they will find something.
What do you guys think?

I was actually expecting something like this from ColdCard too.

This kind of relentless effort by the BTCpay team in trying to recover those stolen funds and to get hold of the attackers is really commendable; it strongly suggests that the team has their merchants at heart despite the deed already being done. In other hands, I think this will also boost users confidence in the team regardless and further increase their belief in the team's quick action or response.

[PostQuantumBTC]

A good bounty can definitely increase the chances of getting information, there are always those that know, but don't say until they perceive a motive to say.

Yes, from crypto hackers that are not wise. It is like you do not know how crypto hack and scam are common.

Unfortunately, we are in an era where even hackers are controlled by governments; not all of them, of course, but some are. I say this because last year, in the Bybit case, where hackers stole US$1.4 billion in ETH, the FBI accused hackers working for North Korea.

They said it but we do not know. The one that we know of very well is the Isreali hacker that hacked the largest crypto exchange in Iran and I think burned the coins.

[joniboini]

In other hands, I think this will also boost users confidence in the team regardless and further increase their belief in the team's quick action or response.

I can't speak for them, but if it were me, as long as the code is verifiable and I can build and test on my own, I think I can try to use them a second time. Probably won't store too much though. But anyway, this depends on the scale of business and whatnot.

Maybe this will become common for other business too in the future. Especially if malicious people can pentest more easily. They need more incentive to encourage people to report and patch bugs instead of exploiting them.

[PrivacyG]

But even if they did offer a bounty, and the funds were returned... they will still have victims pissed at them, due to how long (and extremly difficult more than anything else) the process of returning funds would be.

What I never understood in these 'reclaim' cases is, if this ends up in a Canadian court law suit will the rest of the World be able to claim their return or Canadians only?

[X-ray]

I was actually expecting something like this from ColdCard too.

Thinking about how much larger the scale of the Coldcard hacks were, they could at least offered some white hat bounty for anyone that able to trace the fund and help recover it.

Any white hat activity related to Coldcard that I know of are independent white hat volunteer.

Even a promise to give several percent bounty after the funds recovered is better than simply letting their users do their own thing e.g filing police reports and insurance claims.

Their users don't even know if insurance would cover faulty hardware wallet incident because some insurance exclude it from the claim.

BTCPay on the other hand, seems very committed to make the victims recover their money.

[pooya87]

Unfortunately, we are in an era where even hackers are controlled by governments; not all of them, of course, but some are. I say this because last year, in the Bybit case, where hackers stole US$1.4 billion in ETH, the FBI accused hackers working for North Korea.

In the DMM Bitcoin exchange case, which happened in 2024 and hackers stole US$308 million in Bitcoin, investigations revealed it was a North Korean hacker group. The KuCoin case, where US$281 million in cryptocurrencies were stolen, also points to North Korean hackers, as can be seen in this article:

https://crystalintelligence.com/investigations/the-10-biggest-crypto-hacks-in-history/

I'm posting this to say the following: even if a billion-dollar reward is offered for finding those responsible for this misfortune affecting so many people, it might still not be possible to punish the culprits. Because if they are North Korean hackers...

no other government will catch them in North Korea, and I highly doubt that North Korean hackers would act without orders from the North Korean government. They would probably quickly send everything they stole to the Korean government if they are Korean hackers behind this crime.

Most of the times these claims are used as scapegoats and have no facts to them. It is the legal system trying to close cases so that by the end of some interval they are not accused of being useless and not having closed enough cases. So they choose the best option which is North Korea since they can't complain when they are accused and they also have a history of actually doing these things but most importantly when the legal system says "it was North Korea" what they actually are saying is "we are not going to do anything about it, your funds are gone, suck it up."

[Oasisman]

You can tell that this people mean business



The better the bounty reward the probability of finding the culprits.
Someone somewhere knows something.

If the price is very good it's possible they will find something.
What do you guys think?

I was actually expecting something like this from ColdCard too.

This kind of relentless effort by the BTCpay team in trying to recover those stolen funds and to get hold of the attackers is really commendable; it strongly suggests that the team has their merchants at heart despite the deed already being done. In other hands, I think this will also boost users confidence in the team regardless and further increase their belief in the team's quick action or response.

Well, it's the right thing to do, otherwise some clients will totally distrust them, especially those who got affected.
This attempt to recover the stolen Bitcoin is commendable, but it is not going to be enough to fully restore their client's trust. They need to do more work than just issuing a large bounty.
I think they also need to allocate more funds to create a more secure system, so their server won't show any vulnerability to hackers and incident like this won't happen again.

Should ColdCard do the same bounty? No, I don't think so, the amount was just too big! Imagine the amount they need to allocate if they aggressively offer the same bounty as BTCpay. They'd probably have to put a couple of annual revenue in line for that.

[JeffBrad12]

I think they are looking to following similar directions as other platforms had done in the past, a recent example is the bybit hack. Bybit placed a bounty on the recovery of the assets which was around 10% of the total recovered amount and within few days there was a track of around $40 million by some on-chain analysts. But until now almost half of the stolen assets still is yet to be recovered or tracked. Even though exchanges are actually helping to freeze the address linking to this hacked addresses

Prevention is better, but most of them do not know they will be hacked until it happened. According to what I have read about the Bybit breach was that most of the coins were later hard to trace, Bybit was unable to recover more than 90% of the ether that was stolen by the hackers. The hackers that stole the ethereum were smart.

Bybit hack was state sponsored hacking, it's going to be a lot harder to trace than any hacking caused by non state sponsored individual and the chance for the hacker to return the money is higher. I hope this company can recover the money.