r/coldcard: first-hand report of a 1.6M CAD drain
reddit-1-6m-cad-drained
https://www.reddit.com/r/coldcard/comments/1vc9kxd/16m_cad_drained/
Latest reviewed change
source content difference between and
3 new Reddit comments were posted, including Mission-Disaster-447,SpendHefty6066.
edited: false
body:
This is true. But, I don't think they can drain multi-sigs until they make a transaction. Then the attacker can outbid you in the mempool for that 10 minute window before a block is created. All vulnerable addresses have been compiled and they are now waiting to.ambush multi sig transactions in the mempool.
+
+comment: p1mgjev
+parent: t1_p1l5e0d
+author: Mission-Disaster-447
+created_utc: 1785839625
First lines only. The complete diff is in the timeline below.
- Organisation
- Evidence role
- Community discussion
- Published
- not established
- Source changes
- 1
- Detected differences
- 1
- Unreviewed
- 0
- Copies held
- 2
Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .
This post is held twice: here, with this project's own note on why it matters, and again as part of the conversation captured at , which is polled for changes. Both copies are the same post; neither is a separate event.
Snapshot and diff bodies for this chain monitor are held in the local evidence archive but withheld from the public site because they can contain the addresses of people who published nothing themselves. Capture times and reviewed change summaries remain available below.
Held captures
-
3 new Reddit comments were posted, including Mission-Disaster-447,SpendHefty6066.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 24 lines
edited: false body: This is true. But, I don't think they can drain multi-sigs until they make a transaction. Then the attacker can outbid you in the mempool for that 10 minute window before a block is created. All vulnerable addresses have been compiled and they are now waiting to.ambush multi sig transactions in the mempool. + +comment: p1mgjev +parent: t1_p1l5e0d +author: Mission-Disaster-447 +created_utc: 1785839625 +edited: false +body: +Its a brute forceable problem. They just have to find the 2 private keys that create the correct signature. And this isnt that hard because all possible keys belong to the same small set, if they were all generated with a coldcard that had the rng bug. + +comment: p1mi6ne +parent: t1_p1mgjev +author: SpendHefty6066 +created_utc: 1785840324 +edited: false +body: +Isn't that 40 bit squared? That seems like a lot to brute force. Unless the space is even smaller than this. I still think monitoring the mempool for any multi-sig transactions that use those known keys will be ambushed. There are calls for node runners to turn off RBF for this reason. Replace By Fee allows someone to increase the transaction cost and get priority by miners. + +comment: p1mitlt +parent: t1_p1mi6ne +author: Mission-Disaster-447 +created_utc: 1785840587 +edited: false +body: +I agree that its not the low hanging fruit, but I wouldn‘t rely on it for substantial amounts.Extracted text as captured
post: 1vc9kxd author: itsgood-man created_utc: 1785547714 title: $1.6M cad drained body: Any idea if there’s an organized central place to upload documentation of wallet / transaction id’s in the off-chance that the stolen BTC surfaces on a regulated exchange? I’ve already filed with the authorities. comment: p0zyjee parent: t3_1vc9kxd author: doctordyck created_utc: 1785551830 edited: false body: Get on X and appeal to the Bitcoin community there. People may be willing to help as much as they can. I'm so incredibly sorry. comment: p0zzyqe parent: t1_p0zyjee author: itsgood-man created_utc: 1785552359 edited: false body: [One step ahead of you](https://x.com/itscoachgoodman/status/2083244485400580349). comment: p102wkt parent: t3_1vc9kxd author: 1111Rudy1111 created_utc: 1785553467 edited: false body: Anybody with an MK4 been hacked? comment: p10djbc parent: t1_p102wkt author: is300wrx created_utc: 1785557686 edited: false body: Play it safe and move it.Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 0 lines
Extracted text as captured
post: 1vc9kxd author: itsgood-man created_utc: 1785547714 title: $1.6M cad drained body: Any idea if there’s an organized central place to upload documentation of wallet / transaction id’s in the off-chance that the stolen BTC surfaces on a regulated exchange? I’ve already filed with the authorities. comment: p0zyjee parent: t3_1vc9kxd author: doctordyck created_utc: 1785551830 edited: false body: Get on X and appeal to the Bitcoin community there. People may be willing to help as much as they can. I'm so incredibly sorry. comment: p0zzyqe parent: t1_p0zyjee author: itsgood-man created_utc: 1785552359 edited: false body: [One step ahead of you](https://x.com/itscoachgoodman/status/2083244485400580349). comment: p102wkt parent: t3_1vc9kxd author: 1111Rudy1111 created_utc: 1785553467 edited: false body: Anybody with an MK4 been hacked? comment: p10djbc parent: t1_p102wkt author: is300wrx created_utc: 1785557686 edited: false body: Play it safe and move it.Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
0 presentation-noise differences. Sidebar, ticker and other page chrome churn that our review classified as not being changes to what the source says.
The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.
Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.
Compare the screenshot or a quotation against the original while it is available.