COLDCARD RNG incident the public record, collected and explained
Informational only, and this site never asks for your seed words. details

Informational only. This is an open source collection of what others have published about the incident, together with an explanation of it. It is not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite. Material is attributed and quoted as published; where sources disagree their scenarios are kept separate with their assumptions rather than reconciled into one answer. Everything is meant to be checked against the linked evidence rather than taken on trust. Act on your own judgement about a particular situation. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it, and contributions containing recovery words or private keys are not accepted.

OP_RETURN threat and coinjoin trace

profedustream-2084882092765421800

https://x.com/profedustream/status/2084882092765421800

Captured screenshot of the post by @profedustream, posted 5 Aug 2026, 06:00 UTC
@profedustream posted captured full-size capture → original post →
Author
@profedustream
Organisation
independent
Evidence role
social statement
Posted
Capture status
capture held

Two on-chain observations from 5 August by the analyst whose mapping graph is held at profedustream-mapping-export. First: the address holding the largest share of the stolen coins, given here as 562 BTC across 498 transactions, received an OP_RETURN message reading "I know who you are now" and "You made this bed for yourself, A."; the post links the transaction and asks whether it is a bluff. Second: it traces roughly 65 BTC taken from 465 addresses into a Wasabi coordinator where that input made up about 93 percent of the round, and argues the result identified the output address, mixed only 10.6 BTC and left that output's privacy weak because it was over 37 percent of the mixed coins. The 562 BTC figure matches the largest of the four consolidation addresses in the held Galaxy flow-of-funds post. Both readings, the identification and the conclusion that the operator was incompetent, are the poster's own and are not verified here.

This post is registered as evidence and has a locally held capture. The original remains the canonical publication.

How to check this yourself

Compare the screenshot or a quotation against the original while it is available.