COLDCARD vulnerability what happened, and what to do
Informational only, and this site never asks for your recovery words. details

Informational only. This is independent analysis and an evidence-backed explainer, not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite, Block, or any other party named here. Published estimates are attributed, and differing scenarios are kept separate with their assumptions. Act on your own judgement. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it. Deliberate recovery on independently verified offline equipment is a separate operation. Seed-word safety.

Wallet drained timeline

reddit-drained-timeline

https://www.reddit.com/r/Bitcoin/comments/1vb6teq/wallet_drained_timeline/

Organisation
r/Bitcoin
Evidence role
First-hand account
Published
2026-07-31
Source changes
1
Detected differences
5
Unreviewed
0
Copies held
6

A first-hand account posted while the sweep was still being worked out, before the cause was publicly identified. A rendered capture from 1 Aug 2026 holds the original post and 25 comments locally. Public snapshot and diff text are withheld because the account contains identifying and wallet-specific details.

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked 2 Aug 2026, 00:59 UTC.

Public privacy boundary

Snapshot and diff bodies for this first-hand account are held in the local evidence archive but withheld from the public site because they contain identifying and wallet-specific details. Integrity hashes, capture times and reviewed change summaries remain available below.

  1. capture noise difference between 1 Aug 2026, 09:58 UTC and 1 Aug 2026, 18:13 UTC Current capture noise

    Two already-held comments swapped position in the rendered thread. No post or comment text was added, removed or altered, and the enabled normalizer already suppresses relative-time labels and engagement counts, so comment ordering is the only remaining difference. Reddit orders comments dynamically, so this is rendering variance rather than an edit by the author or moderators.

    seen 1 Aug 2026, 18:13 UTC · Captured here text sha256 15ef3bad46064ba2aba53af9 9,556 chars
  2. capture noise difference between 1 Aug 2026, 09:52 UTC and 1 Aug 2026, 09:58 UTC capture noise

    Fewer lazy-loaded comments were present in this capture than the previous one, and the 'Read more' control was absent. The thread body is unchanged; the missing replies include two that link to the Coinkite advisory. Reddit renders comments progressively, so this is capture variance rather than deletion by the author or moderators.

    seen 1 Aug 2026, 09:58 UTC · Captured here text sha256 188bbeaf77f38ac638a30b5f 9,556 chars
  3. capture noise difference between 1 Aug 2026, 09:21 UTC and 1 Aug 2026, 09:52 UTC capture noise

    More lazy-loaded comments were rendered in this capture than in the previous one, and the 'Read more' control was present again. This is the inverse of the 09:58:01Z capture and the same progressive-rendering variance; no post or comment text already held was altered.

    seen 1 Aug 2026, 09:52 UTC · Captured here text sha256 e6b14f612dab6ec1572bfc14 11,333 chars
  4. source content difference between 1 Aug 2026, 02:59 UTC and 1 Aug 2026, 09:21 UTC source content

    The rendered thread added a comment linking to Gregory Sanders' reported reproduction; one comment present in the preceding capture was no longer rendered.

    seen 1 Aug 2026, 09:21 UTC · Captured here text sha256 188bbeaf77f38ac638a30b5f 9,556 chars
  5. capture correction difference between 1 Aug 2026, 02:45 UTC and 1 Aug 2026, 02:59 UTC capture correction

    A newly enabled comparison normalizer replaced relative-time labels and engagement counts; the post and comment text did not change.

    seen 1 Aug 2026, 02:59 UTC · Captured here text sha256 dd583ec664250456940fb892 9,578 chars
  6. Earliest copy held
    seen 1 Aug 2026, 02:45 UTC · Captured here text sha256 4469b6b7315418669664c0cf 9,347 chars
How to check this yourself

Each copy above is identified by the SHA-256 of its extracted text, shown beside it, and the diffs are plain unified diffs. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.