COLDCARD vulnerability what happened, and what to do
Informational only, and this site never asks for your recovery words. details

Informational only. This is independent analysis and an evidence-backed explainer, not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite, Block, or any other party named here. Published estimates are attributed, and differing scenarios are kept separate with their assumptions. Act on your own judgement. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it. Deliberate recovery on independently verified offline equipment is a separate operation. Seed-word safety.

COLDCARD hack tracker

coldcard-hack-tracker

https://coldcard-hack-tracker.vercel.app/

Organisation
community tracker
Evidence role
Chain monitor
Published
continuously updated
Source changes
18
Detected differences
29
Unreviewed
3
Copies held
30

Second, independent tracker of the same four holding addresses. States the accounting precision the reporting rounded: 1,082.65 BTC drained, 1,082.57 BTC arrived, the difference paid to miners as fees. Cites Galaxy, Coinkite and Block. The page is client-rendered. The empty shell from the first capture is preserved as a capture correction, followed by complete rendered captures. The operator rebuilt the page on 2 August 2026 around a five-wave model, which renamed the section heading this capture previously keyed on. The guard string moved from that heading to "Watched holdings"; "Holding 1" and "Movement feed" are retained because they appear only after the client-side data resolves, so an unrendered shell still fails the check rather than entering the record.

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked 2 Aug 2026, 00:59 UTC.

Public privacy boundary

Snapshot and diff bodies for this chain monitor are held in the local evidence archive but withheld from the public site because they can contain victim addresses. Integrity hashes, capture times and reviewed change summaries remain available below.

  1. unreviewed difference between 2 Aug 2026, 00:31 UTC and 2 Aug 2026, 00:59 UTC Current unreviewed

    This detected difference has not yet been reviewed for capture noise.

    seen 2 Aug 2026, 00:59 UTC · Captured here text sha256 2be4fac53a7e8af1414b7b7a 26,126 chars
  2. unreviewed difference between 2 Aug 2026, 00:17 UTC and 2 Aug 2026, 00:31 UTC unreviewed

    This detected difference has not yet been reviewed for capture noise.

    seen 2 Aug 2026, 00:31 UTC · Captured here text sha256 65230efe46cd4fb6781fe917 7,395 chars
  3. unreviewed difference between 2 Aug 2026, 00:11 UTC and 2 Aug 2026, 00:17 UTC unreviewed

    This detected difference has not yet been reviewed for capture noise.

    seen 2 Aug 2026, 00:17 UTC · Captured here text sha256 805c5353fae53c8ad506eec1 7,551 chars
  4. source content difference between 1 Aug 2026, 21:52 UTC and 2 Aug 2026, 00:11 UTC source content

    The operator rebuilt the tracker around a five-wave model: the July 31 entry split into Galaxy Wave 2 and a new Galaxy Wave 3 spanning Jul 31 to Aug 1, the headline total moved from 1,130.09411114 to 1,368.58411114 BTC, consolidated holdings from 1,130.00551671 to 1,160.19028 BTC, and the July 30 heading was renamed from Galaxy fingerprint to Galaxy Wave 1.

    seen 2 Aug 2026, 00:11 UTC · Captured here text sha256 68fe04147e4c0dac06b6ea84 7,531 chars
  5. capture noise difference between 1 Aug 2026, 21:21 UTC and 1 Aug 2026, 21:52 UTC capture noise

    Only the live fiat conversion changed; the BTC totals, cluster descriptions and movement state were unchanged.

    seen 1 Aug 2026, 21:52 UTC · Captured here text sha256 4df320ab674ab3c379658a9a 6,581 chars
  6. source content difference between 1 Aug 2026, 20:50 UTC and 1 Aug 2026, 21:21 UTC source content

    The evening-wave description gained a clause noting that the Kelbie vault also occurred on 31 July; the live fiat conversion changed in the same capture.

    seen 1 Aug 2026, 21:21 UTC · Captured here text sha256 ee2b7929d1eb0061a01d97b4 6,581 chars
  7. capture noise difference between 1 Aug 2026, 20:18 UTC and 1 Aug 2026, 20:50 UTC capture noise

    Only the live fiat conversion changed; the BTC totals, cluster descriptions and movement state were unchanged.

    seen 1 Aug 2026, 20:50 UTC · Captured here text sha256 f1b84d2990a2cc4f069afe20 6,549 chars
  8. capture noise difference between 1 Aug 2026, 19:47 UTC and 1 Aug 2026, 20:18 UTC capture noise

    Only the live fiat conversion changed; the BTC totals, cluster descriptions and movement state were unchanged.

    seen 1 Aug 2026, 20:18 UTC · Captured here text sha256 00cafe10f83869b4b6c6dd97 6,549 chars
  9. source content difference between 1 Aug 2026, 19:16 UTC and 1 Aug 2026, 19:47 UTC source content

    The tracked total rose to 1,130.09411114 BTC after a delayed 0.19 BTC victim consolidation joined the Aug 1 hop vault. The tracker also recorded an Ocean block-960511 miner payout that touched the hop address and was peeled off, listing it as a possible lead that it does not count as stolen.

    seen 1 Aug 2026, 19:47 UTC · Captured here text sha256 8e5dc70b0aea5715012f70ef 6,549 chars
  10. source content difference between 1 Aug 2026, 18:45 UTC and 1 Aug 2026, 19:16 UTC source content

    The tracker added a 'TOTAL STOLEN' headline of 1,129.90257437 BTC with a four-wave breakdown chart, and raised the balance on watch to 1,130.00551671 BTC after a second UTXO reached the Aug 1 hop vault.

    seen 1 Aug 2026, 19:16 UTC · Captured here text sha256 2a37998a297d8b7f97ea1abf 6,190 chars
  11. source content difference between 1 Aug 2026, 17:43 UTC and 1 Aug 2026, 18:45 UTC source content

    The tracked total rose from 1,129.31416148 to 1,129.81397994 BTC, a separate 'Aug 1 hop vault' holding was added to the evening-wave cluster, the risk checklist gained Mk3 5.0.1 to 5.0.3, a seed-origin item and revised passphrase wording, and WizardSardine and Kevin Loaec were added as sources.

    seen 1 Aug 2026, 18:45 UTC · Captured here text sha256 5ca9fa395ad6401c0d056bdb 5,854 chars
  12. source content difference between 1 Aug 2026, 17:12 UTC and 1 Aug 2026, 17:43 UTC source content

    The tracker restated its movement feed in terms of the reported consolidation only: the earlier outbound spend and unconfirmed hop were removed from the feed, last movement returned to 'Unmoved', and a note was added that later surplus passing through a vault is ignored while the reported balance remains.

    seen 1 Aug 2026, 17:43 UTC · Captured here text sha256 059f3b9cd73a5e764c24b8f8 4,799 chars
  13. source content difference between 1 Aug 2026, 16:41 UTC and 1 Aug 2026, 17:12 UTC source content

    The tracker added an unconfirmed hop-1 movement of 0.4998206 BTC onward from the followed destination of the evening vault's first outbound spend.

    seen 1 Aug 2026, 17:12 UTC · Captured here text sha256 e9c4bdf56dad8e3939411dad 4,849 chars
  14. source content difference between 1 Aug 2026, 16:07 UTC and 1 Aug 2026, 16:41 UTC source content

    The tracker withdrew the Mk4 attribution for the 1 August morning wave, recording the seed as Mk3-origin, removed the 'Mk4 is in scope now' panel, and recorded the first outbound spend of 0.4099166 BTC from the evening vault at 16:33 UTC.

    seen 1 Aug 2026, 16:41 UTC · Captured here text sha256 bb769c34456f9d1eadd13145 4,742 chars
  15. source content difference between 1 Aug 2026, 15:36 UTC and 1 Aug 2026, 16:07 UTC source content

    The tracker's watched balance rose from 1,129.31416148 BTC to 1,129.6240794 BTC and the evening vault's displayed balance and UTXO count changed, while the reported consolidated figure for that vault stayed at 0.50980268 BTC.

    seen 1 Aug 2026, 16:07 UTC · Captured here text sha256 3701a9c48c959de570165990 4,918 chars
  16. source content difference between 1 Aug 2026, 15:05 UTC and 1 Aug 2026, 15:36 UTC source content

    The tracker added an 'Aug 1 morning wave' cluster with a new vault address holding 0.33203236 BTC from 16 sweeps, described it as including a reported Mk4 RNG and duress-wallet honeypot attributed to Tomer Strolight while noting the device model is not visible on chain, added an 'Mk4 is in scope now' panel, and changed its headline to a running total.

    seen 1 Aug 2026, 15:36 UTC · Captured here text sha256 5bd3f98dd87fbb1c594271c6 4,920 chars
  17. source content difference between 1 Aug 2026, 14:34 UTC and 1 Aug 2026, 15:05 UTC source content

    The tracker replaced its likely-exposed paragraph with a per-model vulnerable and fixed version table covering Mk3, Mk4, Mk5, Q and both Edge tracks, and moved the evening vault's block reference from the row label into the cluster description.

    seen 1 Aug 2026, 15:05 UTC · Captured here text sha256 4ea715c7a7f3065a9734284e 4,275 chars
  18. source content difference between 1 Aug 2026, 14:03 UTC and 1 Aug 2026, 14:34 UTC source content

    The tracker rewrote its reader-guidance section against the August 1 advisory and Block's writeup, added a 'beyond the main seed' item covering paper-wallet keys, Seed XOR masks and Key Teleport, clone and Secure Notes material, moved the Galaxy scope figures into the cluster card, and replaced its short source labels with descriptive per-source summaries including CoinDesk and Clay Garrett. Holding 2's UTXO count also changed from one to two.

    seen 1 Aug 2026, 14:34 UTC · Captured here text sha256 1333cf4dab7386c41ef1a64a 4,121 chars
  19. source content difference between 1 Aug 2026, 13:01 UTC and 1 Aug 2026, 14:03 UTC source content

    The tracker added a third cluster, an 'Evening wave' of 31 July with its own 0.50980268 BTC vault attributed to Evan Schoenberg, restated every holding at full satoshi precision, and changed its headline from 1,128.56 BTC across two clusters to 1,129.06986038 BTC across three.

    seen 1 Aug 2026, 14:03 UTC · Captured here text sha256 d3f00997509104cf31855c16 3,418 chars
  20. source content difference between 1 Aug 2026, 10:26 UTC and 1 Aug 2026, 13:01 UTC source content

    The monitor changed Holding 1's displayed UTXO count from ten to eleven while its BTC balance and held status remained unchanged.

    seen 1 Aug 2026, 13:01 UTC · Captured here text sha256 fe258fdf4e6c29915c5b1fa8 3,017 chars
  21. source content difference between 1 Aug 2026, 09:53 UTC and 1 Aug 2026, 10:26 UTC source content

    The monitor changed Holding 1's displayed UTXO count from nine to ten while its BTC balance and held status remained unchanged.

    seen 1 Aug 2026, 10:26 UTC · Captured here text sha256 e79b7068e65e1918136fb604 3,017 chars
  22. source content difference between 1 Aug 2026, 08:35 UTC and 1 Aug 2026, 09:53 UTC source content

    The monitor changed Holding 1's displayed UTXO count from eight to nine while its BTC balance and held status remained unchanged.

    seen 1 Aug 2026, 09:53 UTC · Captured here text sha256 28c3269ebde10669db693c3f 3,016 chars
  23. capture correction difference between 1 Aug 2026, 08:18 UTC and 1 Aug 2026, 08:35 UTC capture correction

    The rendered capture again held the monitor's hydrated chain data after the preceding temporary loading-state capture.

    seen 1 Aug 2026, 08:35 UTC · Captured here text sha256 49b88a5349641eb9b0712193 3,016 chars
  24. capture noise difference between 1 Aug 2026, 08:13 UTC and 1 Aug 2026, 08:18 UTC capture noise

    The rendered capture held the monitor's temporary loading state instead of its hydrated chain data.

    seen 1 Aug 2026, 08:18 UTC · Captured here text sha256 eac729c0105f2a451692554d 2,110 chars
  25. source content difference between 1 Aug 2026, 03:51 UTC and 1 Aug 2026, 08:13 UTC source content

    The monitor changed Holding 1's displayed UTXO count from seven to eight while its BTC balance and held status remained unchanged.

    seen 1 Aug 2026, 08:13 UTC · Captured here text sha256 30478b3d90c0620f5f637884 3,016 chars
  26. source content difference between 1 Aug 2026, 03:22 UTC and 1 Aug 2026, 03:51 UTC source content

    The tracker added a separately attributed 45.91 BTC post-scan cluster and changed its headline total; live fiat figures also changed in the same capture.

    seen 1 Aug 2026, 03:51 UTC · Captured here text sha256 96ce2426f074f44d17e8dbc5 3,009 chars
  27. capture noise difference between 1 Aug 2026, 03:05 UTC and 1 Aug 2026, 03:22 UTC capture noise

    Only live fiat conversions changed; the BTC balances and movement state were unchanged.

    seen 1 Aug 2026, 03:22 UTC · Captured here text sha256 c173a97358454f094072076f 2,435 chars
  28. capture noise difference between 1 Aug 2026, 02:59 UTC and 1 Aug 2026, 03:05 UTC capture noise

    Only live fiat conversions changed; the BTC balances and movement state were unchanged.

    seen 1 Aug 2026, 03:05 UTC · Captured here text sha256 f42e8a280c478e69d158641a 2,435 chars
  29. capture correction difference between 1 Aug 2026, 02:34 UTC and 1 Aug 2026, 02:59 UTC capture correction

    The browser capture obtained the rendered tracker after the initial scripted capture held an empty client-side shell.

    seen 1 Aug 2026, 02:59 UTC · Captured here text sha256 81cc6291302a2f36ff03f880 2,435 chars
  30. Earliest copy held
    seen 1 Aug 2026, 02:34 UTC · Captured here text sha256 e3b0c44298fc1c149afbf4c8 0 chars
How to check this yourself

Each copy above is identified by the SHA-256 of its extracted text, shown beside it, and the diffs are plain unified diffs. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.