COLDCARD RNG incident the public record, collected and explained
Informational only, and this site never asks for your seed words. details

Informational only. This is an open source collection of what others have published about the incident, together with an explanation of it. It is not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite. Material is attributed and quoted as published; where sources disagree their scenarios are kept separate with their assumptions rather than reconciled into one answer. Everything is meant to be checked against the linked evidence rather than taken on trust. Act on your own judgement about a particular situation. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it, and contributions containing recovery words or private keys are not accepted.

Bitcoin cold wallet attack spreads to 4,500 addresses as losses near $89 million

coindesk-third-wave-89m

https://www.coindesk.com/tech/2026/08/02/bitcoin-cold-wallet-attack-spreads-to-4-500-addresses-as-losses-near-usd89-million

Organisation
CoinDesk
Evidence role
Reporting
Published
2026-08-02
Source changes
0
Detected differences
8
Unreviewed
0
Copies held
9

CoinDesk's third-wave follow-up records the changing address and loss estimates on 2 August and distinguishes transaction patterns across waves. Held as a dated reporting state in the evolving funds-attribution record. The figures, wave groupings and causation account are the publisher's and are not verified by registration here.

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .

  1. Earliest copy held
    seen · Internet Archive 6,586 chars replay

    Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.

    Extracted text as captured 
    Search
/
News
Video
Prices
Research
Events
Data & Indices
More
Sponsored
Search
/
en
Sign In
Sign Up
Tech
Bitcoin cold-wallet attack spreads to 4,500 addresses as losses near $89 million
Galaxy Research flagged a third wave of sweeps tied to weak Coldcard-generated keys, with the attacker now targeting smaller balances and changing how funds are collected onchain.
By Shaurya Malwa
Aug 1, 2026, 8:10 p.m.
2 min read
Make preferred on
Share
Share this article
Copy linkX (Twitter)LinkedInFacebookEmail
Make preferred on
Hacker facing screens with lines of code (Boitumelo/Unsplash)
Summary
Show
A vulnerability in a March 2021 Coldcard firmware release has enabled attackers to systematically drain bitcoin from thousands of wallets by reproducing keys generated with weak software-based randomness.
Three distinct waves of attacks have now swept 1,367 bitcoin—nearly $89 million at recent prices—from 4,585 addresses, with the latest wave targeting smaller balances and using more complex, harder-to-trace transaction patterns.
Galaxy Research believes each wave is the work of a single operator, but cannot determine whether the same attacker is behind all three, as the blockchain does not reveal whether separate sweeps are coordinated.
The attacker working through Coldcard-generated keys is now emptying wallets worth a few thousand dollars each.
Galaxy Research flagged a third wave of sweeps early Sunday, roughly 208 bitcoin drained from 1,912 addresses between Friday midday and Saturday morning UTC.
That is just over a tenth of a bitcoin per victim. The July 30 opening wave averaged close to a full coin, 1,083 bitcoin from 1,196 addresses in 41 minutes.
Observed losses across all three waves now total 1,367 bitcoin, nearly $89 million, from 4,585 addresses.
Wave three sends each victim’s coins to its own destination rather than the handful of shared collector addresses that made the first two easy to map, and parks them in pay-to-witness-script-hash outputs, a format that can carry multisignature or timelock conditions, instead of the plain single-key outputs used before.
It batched an average of six victims into each sweep where wave one took exactly one at a time, and it scanned only the default derivation path, the standard branch of the key tree a wallet checks first, instead of testing several branches per seed.
That is either the same operator rebuilding after being enumerated in public or a second one grinding the same vulnerable key space independently, and the chain does not distinguish them.
Galaxy said it is confident each wave is internally one operator, and will not link the three.

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

8 presentation-noise differences. Sidebar, ticker and other page chrome churn that our review classified as not being changes to what the source says.
  • +35 -35 Only the page locale for share controls flipped back to English, relative timestamps rolled, the language selector expanded, and live cryptocurrency ticker values changed. The article body was unchanged.
  • +28 -31 Only the page locale for share controls and relative timestamps flipped to Indonesian, while rotating related-story cards and live cryptocurrency ticker values changed. The article body was unchanged.
  • +24 -24 Only rotating related-story cards, their relative timestamps and live cryptocurrency ticker values changed. The article body was unchanged.
  • +28 -28 Only rotating related-story cards, their relative timestamps, live cryptocurrency ticker values and page locale for timestamps changed. The article body was unchanged.
  • +21 -21 Only rotating related-story cards, their relative timestamps and live cryptocurrency ticker values changed. The article body was unchanged.
  • +20 -20 Only rotating related-story cards, their relative timestamps and live cryptocurrency ticker values changed. The article body was unchanged.
  • +7 -7 Only relative story timestamps and live cryptocurrency ticker values changed. The article body was unchanged.
  • +22 -22 Only rotating related-story cards, their relative timestamps and live cryptocurrency ticker values changed. The article body was unchanged.
How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.