I traced Wave 1 of the Coldcard drain from the weak firmware RNG to 1,195 victim addresses, reconstructed 328 seeds covering 949.7 BTC, and found clues in the attacker’s sweep code. The final 153 addresses remain unexplained.
Article

Inside Wave 1: Tracing the Attacker’s Steps Through the 1,082 BTC Coldcard Drain

This post answers three questions: Why were these wallets vulnerable? What can be reconstructed from the blockchain? What does that reconstruction tell us about the attacker? I’m the developer of

Aug 13, 2026 · 4:16 PM UTC

20
52
255
105,765
Praveen Perera
@PraveenPerera
Aug 14
Some people have asked me for more detail on everything I tried to find the 153 remaining addresses, wrote a quick post detailing that. If you think I missed something, please let me know. praveenperera.com/blog/coldc…
1
664
Sort replies: Relevant Recent Liked
Replying to @PraveenPerera
Very cool, but can you move/write a Summary amd/or Findings section at the top??
1
3
1,140
Good call, will edit article in a bit. praveenperera.com/blog/coldc…

Inside Wave 1: Tracing the Attacker’s Steps Through the 1,082 BTC Coldcard Drain | Praveen Perera

A forensic reconstruction of the 1,082 BTC Coldcard Wave 1 drain, the weak seed path behind it, and the 153 addresses that remain unexplained

praveenperera.com
3
991
Replying to @PraveenPerera
Couldn't those 153 addresses be behind passphrase wallets?
2
2
397
tried praveenperera.com/blog/coldc…

The Missing 153: What I Tried After Reconstructing Coldcard Wave 1 | Praveen Perera

A complete account of the derivation paths, Coldcard states, pad ranges, dice rolls, passphrases, 12-word seeds, and paper wallets tested while searching for the 153 unresolved Wave 1 addresses

praveenperera.com
1
282
Replying to @PraveenPerera
great post, any progress on figuring out those extra seeds?
1
1
454
Nope! I’ve run some more scans, they keep showing up seeds that were taken later but still missing 153 addresses. I think I’ll make a short post explaining everything I’ve tried. I’ve tried like 100+ billion seed checks, 5 trillion address checks $200+ GPU spend and nothing still.
3
1
431
more replies
Replying to @PraveenPerera
Someone reproduced 4/153: bip84_recv[0] bc1qkxz7da2y32qf6zg4xp4glp04g7eazyvna9cfce bip84_recv[0] bc1q3tuuk4pw72nqdeazfq5x7eux0l58n85926ghlt bip84_recv[0,1] bc1qtexax0udejaq2d98k7fmjpmwfupf2r8sc4k5zj bc1qtedmdcmncmvdal55dt7yzc3jrk7gzug8pyn4cl
11
Replying to @PraveenPerera
I have a suspicion that someone at bitkey was behind this. They were first to sound the alarm. Then they look like the good guys and they are also the ones that benefit the most from this attack after stoking fears about single sig wallets. Then they conveniently drop the price of bitkey to draw in people fleeing coldcard 🐠 🐟 🤔
1
5
635
Replying to @PraveenPerera
Will LE help in recovering funds? How will people prove ownership?
1
96
Replying to @PraveenPerera
I think it's very likely explained by fake sweeps giving them near perfect plausible deniability.
1
247
Replying to @PraveenPerera
Thanks ChatGPT 👍
1
466
Replying to @PraveenPerera
i understand maybe 10 or 20% of this. Do you think in future you might make a new version of your analysis in layman's terms? For example would be good to know how probable you think it is that there is an "inside job" aspect to this hack.
48
Replying to @PraveenPerera
💪💪💪
270
Replying to @PraveenPerera
Such level of detail!
435