r/Bitcoin: report of nearly 1,400 BTC hacked from COLDCARD wallets
reddit-1400-btc-hacked-report
https://www.reddit.com/r/Bitcoin/comments/1veauv2/nearly_1400_bitcoin_hacked_from_coldcard_wallets/
Latest reviewed change
source content difference between and
The original post was deleted: author HumbleRestaurant790 is now [deleted] and the post body shows [deleted]. The title and comments remain.
post: 1veauv2
-author: HumbleRestaurant790
+author: [deleted]
created_utc: 1785756784
title: Nearly 1,400 Bitcoin Hacked from Coldcard Wallets
+body:
+[deleted]
First lines only. The complete diff is in the timeline below.
- Organisation
- Evidence role
- Community discussion
- Published
- not established
- Source changes
- 7
- Detected differences
- 7
- Unreviewed
- 0
- Copies held
- 8
Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .
This post is held twice: here, with this project's own note on why it matters, and again as part of the conversation captured at , which is polled for changes. Both copies are the same post; neither is a separate event.
Snapshot and diff bodies for this chain monitor are held in the local evidence archive but withheld from the public site because they can contain the addresses of people who published nothing themselves. Capture times and reviewed change summaries remain available below.
Held captures
-
The original post was deleted: author HumbleRestaurant790 is now [deleted] and the post body shows [deleted]. The title and comments remain.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 4 lines
post: 1veauv2 -author: HumbleRestaurant790 +author: [deleted] created_utc: 1785756784 title: Nearly 1,400 Bitcoin Hacked from Coldcard Wallets +body: +[deleted] comment: p1ffcm9 parent: t3_1veauv2Extracted text as captured
post: 1veauv2 author: [deleted] created_utc: 1785756784 title: Nearly 1,400 Bitcoin Hacked from Coldcard Wallets body: [deleted] comment: p1ffcm9 parent: t3_1veauv2 author: puck2 created_utc: 1785757034 edited: false body: I feel like they could have gotten away with 20~40 bitcoins but they got greedy and will get caught comment: p1ffwfn parent: t1_p1ffcm9 author: Waldschratsuppe created_utc: 1785757245 edited: false body: definitely more than one hacker by now. Maybe thousands of people trying their „luck“. comment: p1ffyxm parent: t1_p1ffcm9 author: DynamicCast created_utc: 1785757271 edited: false body: Could be multiple people at this point, the vulnerability is well known and easily discoverable comment: p1fgmt9 parent: t3_1veauv2 author: [deleted] created_utc: 1785757519 edited: 1786028003 body: [deleted] held before deletion (captured 20260805T142526Z):Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
Two comments by IllllIIlIllIllllIlll were deleted: one remarking it was their first time hearing of the hack, one sarcasm remark. Both now show author and body [deleted].
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 16 lines
comment: p1fgmt9 parent: t3_1veauv2 -author: IllllIIlIllIllllIlll +author: [deleted] created_utc: 1785757519 -edited: false -body: -Damn, it's definitely my first time hearing about this one! How come nobody has ever made a post about it? +edited: 1786028003 +body: +[deleted] comment: p1fgnie parent: t3_1veauv2 comment: p1fs6ok parent: t1_p1fl2sz -author: IllllIIlIllIllllIlll +author: [deleted] created_utc: 1785761480 -edited: false -body: -Nah, fuck the s. Obvious sarcasm is obvious. +edited: 1786027967 +body: +[deleted] comment: p1fsjqm parent: t1_p1fki7lExtracted text as captured
post: 1veauv2 author: HumbleRestaurant790 created_utc: 1785756784 title: Nearly 1,400 Bitcoin Hacked from Coldcard Wallets comment: p1ffcm9 parent: t3_1veauv2 author: puck2 created_utc: 1785757034 edited: false body: I feel like they could have gotten away with 20~40 bitcoins but they got greedy and will get caught comment: p1ffwfn parent: t1_p1ffcm9 author: Waldschratsuppe created_utc: 1785757245 edited: false body: definitely more than one hacker by now. Maybe thousands of people trying their „luck“. comment: p1ffyxm parent: t1_p1ffcm9 author: DynamicCast created_utc: 1785757271 edited: false body: Could be multiple people at this point, the vulnerability is well known and easily discoverable comment: p1fgmt9 parent: t3_1veauv2 author: [deleted] created_utc: 1785757519 edited: 1786028003 body: [deleted] held before deletion (captured 20260805T142526Z): Damn, it's definitely my first time hearing about this one! How come nobody has ever made a post about it?Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
Several comments were removed or replaced with deleted-account placeholders, including discussion of passphrases, vendor responsibility and regulation.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 28 lines
body: Why are there no white hats stepping in?? -comment: p1g55ol -parent: t1_p1fuqps -author: OldHamburger7923 -created_utc: 1785765331 -edited: false -body: -Dumb. We all use passwords for every account we use, even the ones with 2fa. Even if it's just your mom's dob, that helps. - -I've always used a passphrase. But on reddit a ton of people kept saying it makes losing your coins easier. Group think can be wrong. - comment: p1g5ugv parent: t1_p1fpybc author: Jonassydney edited: false body: Anyone with Claude code can find the vulnerability now that someone else found it and it's been published on ten thousand sites on the internet for Claude to copy/paste from. - -comment: p1g7lnq -parent: t1_p1fgyng -author: OldHamburger7923 -created_utc: 1785766010 -edited: false -body: -If it was one minor issue or bug, but this is a major flaw on a critical system and it was in place for 5 years while they made other random BS products. comment: p1g8bwb parent: t1_p1fuqps comment: p1hb9bc parent: t1_p1h4nwd -author: yet-again-temporary +author: [deleted] created_utc: 1785776266 edited: false body: ->Yea, just because we want our money decentralized does not mean you can be a bad actor in said space. - -I mean it quite literally does lmao. That's the free market at work, if you don't like a company then vote with your wallet and stop financially supporting them. - -Calling for regulations every time there's a situation like this goes against the very principles that crypto was founded on, and defeats the entire point. No regulations means no regulations, good *and* bad. - -"Those who would give up essential Liberty, to purchase a little temporary Safety, ***deserve neither Liberty nor Safety***." +[deleted] comment: p1hc260 parent: t1_p1gtmpfExtracted text as captured
post: 1veauv2 author: HumbleRestaurant790 created_utc: 1785756784 title: Nearly 1,400 Bitcoin Hacked from Coldcard Wallets comment: p1ffcm9 parent: t3_1veauv2 author: puck2 created_utc: 1785757034 edited: false body: I feel like they could have gotten away with 20~40 bitcoins but they got greedy and will get caught comment: p1ffwfn parent: t1_p1ffcm9 author: Waldschratsuppe created_utc: 1785757245 edited: false body: definitely more than one hacker by now. Maybe thousands of people trying their „luck“. comment: p1ffyxm parent: t1_p1ffcm9 author: DynamicCast created_utc: 1785757271 edited: false body: Could be multiple people at this point, the vulnerability is well known and easily discoverable comment: p1fgmt9 parent: t3_1veauv2 author: IllllIIlIllIllllIlll created_utc: 1785757519 edited: false body: Damn, it's definitely my first time hearing about this one! How come nobody has ever made a post about it? comment: p1fgnie parent: t3_1veauv2 author: NashDaypring1987Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
The thread gained a reply saying dice rolls and passphrases were not standard advice five years ago, and alleging that official setup material used a generated seed phrase.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 10 lines
body: I mean, if Crowdstrike can take the world down and survive, surely a hacked wallet can? +comment: p1sjkus +parent: t1_p1fuqps +author: FudgeAdventurous3875 +created_utc: 1785904196 +edited: false +body: +Seriously everyone is acting like dice rolls and passphrases are standard. 5 years ago it was common thought that using these advanced options increased user error and chance to lock yourself out, like the people that dice rolled one time and lost their funds because they didnt know what they were doing. 5 years ago there was VERY little instructions on how to even use ColdCard. CoinKites official setup video from 4 years ago doesnt even mention it and uses the generated seed phrase. + +In 5 years people could be calling each other idiots for only using 50 dice rolls instead of 100 or only using 2/3 multisig instead of 3/5. + more-stub: parent t1_p1isqg5 count <live-count>Extracted text as captured
post: 1veauv2 author: HumbleRestaurant790 created_utc: 1785756784 title: Nearly 1,400 Bitcoin Hacked from Coldcard Wallets comment: p1ffcm9 parent: t3_1veauv2 author: puck2 created_utc: 1785757034 edited: false body: I feel like they could have gotten away with 20~40 bitcoins but they got greedy and will get caught comment: p1ffwfn parent: t1_p1ffcm9 author: Waldschratsuppe created_utc: 1785757245 edited: false body: definitely more than one hacker by now. Maybe thousands of people trying their „luck“. comment: p1ffyxm parent: t1_p1ffcm9 author: DynamicCast created_utc: 1785757271 edited: false body: Could be multiple people at this point, the vulnerability is well known and easily discoverable comment: p1fgmt9 parent: t3_1veauv2 author: IllllIIlIllIllllIlll created_utc: 1785757519 edited: false body: Damn, it's definitely my first time hearing about this one! How come nobody has ever made a post about it? comment: p1fgnie parent: t3_1veauv2 author: NashDaypring1987Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
The Reddit thread gained 1 new comment.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 8 lines
body: Their code was not tested at all, and extremely poorly designed. This wasn't a mistake that could happen to someone with proper care, and actually espousing the "strong safety" practices they were so loud about publicly. +comment: p1pf8li +parent: t1_p1fgnie +author: Fangletron +created_utc: 1785869692 +edited: false +body: +I mean, if Crowdstrike can take the world down and survive, surely a hacked wallet can? + more-stub: parent t1_p1isqg5 count 0Extracted text as captured
post: 1veauv2 author: HumbleRestaurant790 created_utc: 1785756784 title: Nearly 1,400 Bitcoin Hacked from Coldcard Wallets comment: p1ffcm9 parent: t3_1veauv2 author: puck2 created_utc: 1785757034 edited: false body: I feel like they could have gotten away with 20~40 bitcoins but they got greedy and will get caught comment: p1ffwfn parent: t1_p1ffcm9 author: Waldschratsuppe created_utc: 1785757245 edited: false body: definitely more than one hacker by now. Maybe thousands of people trying their „luck“. comment: p1ffyxm parent: t1_p1ffcm9 author: DynamicCast created_utc: 1785757271 edited: false body: Could be multiple people at this point, the vulnerability is well known and easily discoverable comment: p1fgmt9 parent: t3_1veauv2 author: IllllIIlIllIllllIlll created_utc: 1785757519 edited: false body: Damn, it's definitely my first time hearing about this one! How come nobody has ever made a post about it? comment: p1fgnie parent: t3_1veauv2 author: NashDaypring1987Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
2 new Reddit comments were posted, both by NakedNick_ballin, criticizing the project's testing and design.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 16 lines
body: That's even worse... +comment: p1nzxz0 +parent: t3_1veauv2 +author: NakedNick_ballin +created_utc: 1785856873 +edited: false +body: +And now people will learn how trash open source can be + +comment: p1o0heq +parent: t1_p1gtrpq +author: NakedNick_ballin +created_utc: 1785857015 +edited: false +body: +Their code was not tested at all, and extremely poorly designed. This wasn't a mistake that could happen to someone with proper care, and actually espousing the "strong safety" practices they were so loud about publicly. + more-stub: parent t1_p1isqg5 count 0Extracted text as captured
post: 1veauv2 author: HumbleRestaurant790 created_utc: 1785756784 title: Nearly 1,400 Bitcoin Hacked from Coldcard Wallets comment: p1ffcm9 parent: t3_1veauv2 author: puck2 created_utc: 1785757034 edited: false body: I feel like they could have gotten away with 20~40 bitcoins but they got greedy and will get caught comment: p1ffwfn parent: t1_p1ffcm9 author: Waldschratsuppe created_utc: 1785757245 edited: false body: definitely more than one hacker by now. Maybe thousands of people trying their „luck“. comment: p1ffyxm parent: t1_p1ffcm9 author: DynamicCast created_utc: 1785757271 edited: false body: Could be multiple people at this point, the vulnerability is well known and easily discoverable comment: p1fgmt9 parent: t3_1veauv2 author: IllllIIlIllIllllIlll created_utc: 1785757519 edited: false body: Damn, it's definitely my first time hearing about this one! How come nobody has ever made a post about it? comment: p1fgnie parent: t3_1veauv2 author: NashDaypring1987Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
3 new Reddit comments were posted, including calambacle,PracticalPianist6189,jmeador42.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 24 lines
body: Your governments. You know that thing that runs the county you are in. I don't want my government to have total control over a currency, however I don't want a lawless hell scape either. We can have a decentralized yet regulated asset. +comment: p1mk0jj +parent: t3_1veauv2 +author: calambacle +created_utc: 1785841074 +edited: false +body: +Not your softwares not your shit + +comment: p1n7p0u +parent: t1_p1hn4t5 +author: PracticalPianist6189 +created_utc: 1785849195 +edited: false +body: +It was just “runs”. What a shame. + +comment: p1nd73d +parent: t1_p1n7p0u +author: jmeador42 +created_utc: 1785850777 +edited: false +body: +That's even worse... + more-stub: parent t1_p1isqg5 count 0Extracted text as captured
post: 1veauv2 author: HumbleRestaurant790 created_utc: 1785756784 title: Nearly 1,400 Bitcoin Hacked from Coldcard Wallets comment: p1ffcm9 parent: t3_1veauv2 author: puck2 created_utc: 1785757034 edited: false body: I feel like they could have gotten away with 20~40 bitcoins but they got greedy and will get caught comment: p1ffwfn parent: t1_p1ffcm9 author: Waldschratsuppe created_utc: 1785757245 edited: false body: definitely more than one hacker by now. Maybe thousands of people trying their „luck“. comment: p1ffyxm parent: t1_p1ffcm9 author: DynamicCast created_utc: 1785757271 edited: false body: Could be multiple people at this point, the vulnerability is well known and easily discoverable comment: p1fgmt9 parent: t3_1veauv2 author: IllllIIlIllIllllIlll created_utc: 1785757519 edited: false body: Damn, it's definitely my first time hearing about this one! How come nobody has ever made a post about it? comment: p1fgnie parent: t3_1veauv2 author: NashDaypring1987Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 0 lines
Extracted text as captured
post: 1veauv2 author: HumbleRestaurant790 created_utc: 1785756784 title: Nearly 1,400 Bitcoin Hacked from Coldcard Wallets comment: p1ffcm9 parent: t3_1veauv2 author: puck2 created_utc: 1785757034 edited: false body: I feel like they could have gotten away with 20~40 bitcoins but they got greedy and will get caught comment: p1ffwfn parent: t1_p1ffcm9 author: Waldschratsuppe created_utc: 1785757245 edited: false body: definitely more than one hacker by now. Maybe thousands of people trying their „luck“. comment: p1ffyxm parent: t1_p1ffcm9 author: DynamicCast created_utc: 1785757271 edited: false body: Could be multiple people at this point, the vulnerability is well known and easily discoverable comment: p1fgmt9 parent: t3_1veauv2 author: IllllIIlIllIllllIlll created_utc: 1785757519 edited: false body: Damn, it's definitely my first time hearing about this one! How come nobody has ever made a post about it? comment: p1fgnie parent: t3_1veauv2 author: NashDaypring1987Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
0 presentation-noise differences. Sidebar, ticker and other page chrome churn that our review classified as not being changes to what the source says.
The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.
Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.
Compare the screenshot or a quotation against the original while it is available.