I traced Wave 1 of the Coldcard drain from the weak firmware RNG to 1,195 victim addresses, reconstructed 328 seeds covering 949.7 BTC, and found clues in the attacker’s sweep code. The final 153 addresses remain unexplained.
Article

Inside Wave 1: Tracing the Attacker’s Steps Through the 1,082 BTC Coldcard Drain

This post answers three questions: Why were these wallets vulnerable? What can be reconstructed from the blockchain? What does that reconstruction tell us about the attacker? I’m the developer of

20
52
255
105,765
Replying to @PraveenPerera
I think it's very likely explained by fake sweeps giving them near perfect plausible deniability.

Aug 14, 2026 · 2:30 PM UTC
1
247
Sort replies: Relevant Recent Liked