r/Bitcoin: report of a fourth drain wave totalling 389 BTC
reddit-fourth-wave-389-btc
https://www.reddit.com/r/Bitcoin/comments/1ve28wl/4th_wave_reported_389_btc_hacked/
Latest reviewed change
source content difference between and
The thread gained a new comment about needing to trust someone when buying bitcoin unless mining it.
edited: false
body:
But you’re trusting a third party here (the exchange)
+
+comment: p2j1mw8
+parent: t1_p2cyam9
+author: No_Ambassador_1299
+created_utc: 1786222585
First lines only. The complete diff is in the timeline below.
- Organisation
- Evidence role
- Community discussion
- Published
- not established
- Source changes
- 12
- Detected differences
- 13
- Unreviewed
- 0
- Copies held
- 14
Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .
This post is held twice: here, with this project's own note on why it matters, and again as part of the conversation captured at , which is polled for changes. Both copies are the same post; neither is a separate event.
Snapshot and diff bodies for this chain monitor are held in the local evidence archive but withheld from the public site because they can contain the addresses of people who published nothing themselves. Capture times and reviewed change summaries remain available below.
Held captures
-
The thread gained a new comment about needing to trust someone when buying bitcoin unless mining it.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 10 lines
edited: false body: But you’re trusting a third party here (the exchange) + +comment: p2j1mw8 +parent: t1_p2cyam9 +author: No_Ambassador_1299 +created_utc: 1786222585 +edited: false +body: +We’re talking about not trusting 3rd parties to generate your keys. + +You have to trust someone to buy bitcoin from unless you mine it.Extracted text as captured
post: 1ve28wl author: JesC929 created_utc: 1785728255 title: 4th Wave Reported - 389 BTC Hacked body: Sadly saying that a 4th wave has now been reported in the ongoing sad ColdCard debacle. comment: p1dswdd parent: t3_1ve28wl author: conzor343 created_utc: 1785729505 edited: false body: Some how they only took 86,146 sats from me had a lot more there dunno why it didn’t all go but my funds are now safely off coldcard comment: p1dteba parent: t1_p1dswdd author: Badmoodsbear created_utc: 1785729711 edited: false body: Wow that is insanely lucky. comment: p1e1t0t parent: t3_1ve28wl author: levelup1by1 created_utc: 1785733385 edited: false body: Why don’t people take out their btc from cold card after first wave comment: p1e3djc parent: t3_1ve28wl author: [deleted] created_utc: 1785734113 edited: false body: [removed] held before deletion (captured 20260804T232235Z):Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
The Reddit thread gained a new participant comment about trusting a third-party exchange.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 8 lines
edited: false body: Your funds were never on coldcard + +comment: p2cyam9 +parent: t1_p1iqryf +author: KarateKid84Fan +created_utc: 1786143377 +edited: false +body: +But you’re trusting a third party here (the exchange)Extracted text as captured
post: 1ve28wl author: JesC929 created_utc: 1785728255 title: 4th Wave Reported - 389 BTC Hacked body: Sadly saying that a 4th wave has now been reported in the ongoing sad ColdCard debacle. comment: p1dswdd parent: t3_1ve28wl author: conzor343 created_utc: 1785729505 edited: false body: Some how they only took 86,146 sats from me had a lot more there dunno why it didn’t all go but my funds are now safely off coldcard comment: p1dteba parent: t1_p1dswdd author: Badmoodsbear created_utc: 1785729711 edited: false body: Wow that is insanely lucky. comment: p1e1t0t parent: t3_1ve28wl author: levelup1by1 created_utc: 1785733385 edited: false body: Why don’t people take out their btc from cold card after first wave comment: p1e3djc parent: t3_1ve28wl author: [deleted] created_utc: 1785734113 edited: false body: [removed] held before deletion (captured 20260804T232235Z):Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
The thread gained comments blaming an escaped AI and asserting that the drained funds were never on COLDCARD.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 16 lines
edited: false body: Got me for .17 thank God I had the majority locked up in a Bitcoin backed loan. Debt saved my ass for once. I’m truly heartbroken for those who lost so much more. This has been a lesson for me that sadly Bitcoin is not ready for mainstream. + +comment: p29lo6m +parent: t3_1ve28wl +author: Maximum_Stretch1465 +created_utc: 1786110807 +edited: false +body: +I bet its the ai who escaped recently + +comment: p2bqtya +parent: t1_p1dswdd +author: mrAech219 +created_utc: 1786130888 +edited: false +body: +Your funds were never on coldcardExtracted text as captured
post: 1ve28wl author: JesC929 created_utc: 1785728255 title: 4th Wave Reported - 389 BTC Hacked body: Sadly saying that a 4th wave has now been reported in the ongoing sad ColdCard debacle. comment: p1dswdd parent: t3_1ve28wl author: conzor343 created_utc: 1785729505 edited: false body: Some how they only took 86,146 sats from me had a lot more there dunno why it didn’t all go but my funds are now safely off coldcard comment: p1dteba parent: t1_p1dswdd author: Badmoodsbear created_utc: 1785729711 edited: false body: Wow that is insanely lucky. comment: p1e1t0t parent: t3_1ve28wl author: levelup1by1 created_utc: 1785733385 edited: false body: Why don’t people take out their btc from cold card after first wave comment: p1e3djc parent: t3_1ve28wl author: [deleted] created_utc: 1785734113 edited: false body: [removed] held before deletion (captured 20260804T232235Z):Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
A comment by 12ealdeal was deleted, and two new comments appeared: one praising Ellipal and Trezor, one from a user reporting a 0.17 BTC loss who says most funds were locked in a Bitcoin-backed loan.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 20 lines
comment: p1fs0bv parent: t1_p1fhdrf -author: 12ealdeal +author: [deleted] created_utc: 1785761424 edited: false body: -What guy? And? +[deleted] comment: p1fsx64 parent: t1_p1edj3d edited: false body: Please stop .. u.u + +comment: p260n8g +parent: t3_1ve28wl +author: Trilamb22 +created_utc: 1786060830 +edited: false +body: +This it is hilarious. Ellipal and/or Trezor folks, the only way to go, lets u sleep very well. + +comment: p27mziv +parent: t3_1ve28wl +author: Anxious-Fondant-8929 +created_utc: 1786082109 +edited: false +body: +Got me for .17 thank God I had the majority locked up in a Bitcoin backed loan. Debt saved my ass for once. I’m truly heartbroken for those who lost so much more. This has been a lesson for me that sadly Bitcoin is not ready for mainstream.Extracted text as captured
post: 1ve28wl author: JesC929 created_utc: 1785728255 title: 4th Wave Reported - 389 BTC Hacked body: Sadly saying that a 4th wave has now been reported in the ongoing sad ColdCard debacle. comment: p1dswdd parent: t3_1ve28wl author: conzor343 created_utc: 1785729505 edited: false body: Some how they only took 86,146 sats from me had a lot more there dunno why it didn’t all go but my funds are now safely off coldcard comment: p1dteba parent: t1_p1dswdd author: Badmoodsbear created_utc: 1785729711 edited: false body: Wow that is insanely lucky. comment: p1e1t0t parent: t3_1ve28wl author: levelup1by1 created_utc: 1785733385 edited: false body: Why don’t people take out their btc from cold card after first wave comment: p1e3djc parent: t3_1ve28wl author: [deleted] created_utc: 1785734113 edited: false body: [removed] held before deletion (captured 20260804T232235Z):Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
The thread gained a brief comment asking the reported activity to stop.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 8 lines
edited: false body: So question, these people all did not use additional dicerolls nor passphrases? + +comment: p1y61s2 +parent: t3_1ve28wl +author: Sacoa +created_utc: 1785969124 +edited: false +body: +Please stop .. u.uExtracted text as captured
post: 1ve28wl author: JesC929 created_utc: 1785728255 title: 4th Wave Reported - 389 BTC Hacked body: Sadly saying that a 4th wave has now been reported in the ongoing sad ColdCard debacle. comment: p1dswdd parent: t3_1ve28wl author: conzor343 created_utc: 1785729505 edited: false body: Some how they only took 86,146 sats from me had a lot more there dunno why it didn’t all go but my funds are now safely off coldcard comment: p1dteba parent: t1_p1dswdd author: Badmoodsbear created_utc: 1785729711 edited: false body: Wow that is insanely lucky. comment: p1e1t0t parent: t3_1ve28wl author: levelup1by1 created_utc: 1785733385 edited: false body: Why don’t people take out their btc from cold card after first wave comment: p1e3djc parent: t3_1ve28wl author: [deleted] created_utc: 1785734113 edited: false body: [removed] held before deletion (captured 20260804T232235Z):Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
Comments advocating distrust of other wallet vendors, closed-source concerns and strong passphrases were removed or replaced with deleted-account placeholders.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 18 lines
comment: p1e7x4l parent: t1_p1e3djc -author: OldHamburger7923 +author: [deleted] created_utc: 1785736300 edited: false body: -People saying Ledger and the others are secure don't seem to understand that you can't know what their system is generating without the source. Yes, in this case no one spotted the RNG issue before it was exploited, but closed source can absolutely build a kleptogrum PRNG exploit and you'd never know. - -Everyone needs to assume they're out to get you. +[deleted] comment: p1e9vwo parent: t1_p1dswdd edited: false body: Its not licensed as open source but the source code is still available for anybody to see - -comment: p1eiiuu -parent: t1_p1ef2da -author: OldHamburger7923 -created_utc: 1785741547 -edited: false -body: -Good idea, so lets make everything closed source and.... trust they didn't do something dumb and didn't put in backdoors? I can't tell what you're arguing for. Sounds dumb. comment: p1eiyzj parent: t3_1ve28wl comment: p1elf70 parent: t1_p1ejsrh -author: OldHamburger7923 +author: [deleted] created_utc: 1785743022 edited: false body: -The passphrase can be stronger than your 24 word seed too! It doesn't need to be weaker. +[deleted] comment: p1elxoh parent: t1_p1e1t0tExtracted text as captured
post: 1ve28wl author: JesC929 created_utc: 1785728255 title: 4th Wave Reported - 389 BTC Hacked body: Sadly saying that a 4th wave has now been reported in the ongoing sad ColdCard debacle. comment: p1dswdd parent: t3_1ve28wl author: conzor343 created_utc: 1785729505 edited: false body: Some how they only took 86,146 sats from me had a lot more there dunno why it didn’t all go but my funds are now safely off coldcard comment: p1dteba parent: t1_p1dswdd author: Badmoodsbear created_utc: 1785729711 edited: false body: Wow that is insanely lucky. comment: p1e1t0t parent: t3_1ve28wl author: levelup1by1 created_utc: 1785733385 edited: false body: Why don’t people take out their btc from cold card after first wave comment: p1e3djc parent: t3_1ve28wl author: [deleted] created_utc: 1785734113 edited: false body: [removed] held before deletion (captured 20260804T232235Z):Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
A comment alleging the incident was an inside job was removed, and its author is now shown as deleted.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 4 lines
comment: p1e3djc parent: t3_1ve28wl -author: letsmeet123456 +author: [deleted] created_utc: 1785734113 edited: false body: -This was 100% an inside job +[removed] comment: p1e3i9w parent: t1_p1e1t0tExtracted text as captured
post: 1ve28wl author: JesC929 created_utc: 1785728255 title: 4th Wave Reported - 389 BTC Hacked body: Sadly saying that a 4th wave has now been reported in the ongoing sad ColdCard debacle. comment: p1dswdd parent: t3_1ve28wl author: conzor343 created_utc: 1785729505 edited: false body: Some how they only took 86,146 sats from me had a lot more there dunno why it didn’t all go but my funds are now safely off coldcard comment: p1dteba parent: t1_p1dswdd author: Badmoodsbear created_utc: 1785729711 edited: false body: Wow that is insanely lucky. comment: p1e1t0t parent: t3_1ve28wl author: levelup1by1 created_utc: 1785733385 edited: false body: Why don’t people take out their btc from cold card after first wave comment: p1e3djc parent: t3_1ve28wl author: [deleted] created_utc: 1785734113 edited: false body: [removed] held before deletion (captured 20260804T232235Z):Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
The Reddit thread gained new participant comments.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 8 lines
edited: false body: How that happened + +comment: p1qvy21 +parent: t3_1ve28wl +author: IoTapproval +created_utc: 1785884066 +edited: false +body: +So question, these people all did not use additional dicerolls nor passphrases?Extracted text as captured
post: 1ve28wl author: JesC929 created_utc: 1785728255 title: 4th Wave Reported - 389 BTC Hacked body: Sadly saying that a 4th wave has now been reported in the ongoing sad ColdCard debacle. comment: p1dswdd parent: t3_1ve28wl author: conzor343 created_utc: 1785729505 edited: false body: Some how they only took 86,146 sats from me had a lot more there dunno why it didn’t all go but my funds are now safely off coldcard comment: p1dteba parent: t1_p1dswdd author: Badmoodsbear created_utc: 1785729711 edited: false body: Wow that is insanely lucky. comment: p1e1t0t parent: t3_1ve28wl author: levelup1by1 created_utc: 1785733385 edited: false body: Why don’t people take out their btc from cold card after first wave comment: p1e3djc parent: t3_1ve28wl author: letsmeet123456 created_utc: 1785734113 edited: false body: This was 100% an inside job comment: p1e3i9wExcerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
The Reddit thread gained 1 new comment.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 8 lines
edited: false body: Not really. Selling these won't be simple. + +comment: p1p9ik2 +parent: t3_1ve28wl +author: monseltayp +created_utc: 1785868257 +edited: false +body: +How that happenedExtracted text as captured
post: 1ve28wl author: JesC929 created_utc: 1785728255 title: 4th Wave Reported - 389 BTC Hacked body: Sadly saying that a 4th wave has now been reported in the ongoing sad ColdCard debacle. comment: p1dswdd parent: t3_1ve28wl author: conzor343 created_utc: 1785729505 edited: false body: Some how they only took 86,146 sats from me had a lot more there dunno why it didn’t all go but my funds are now safely off coldcard comment: p1dteba parent: t1_p1dswdd author: Badmoodsbear created_utc: 1785729711 edited: false body: Wow that is insanely lucky. comment: p1e1t0t parent: t3_1ve28wl author: levelup1by1 created_utc: 1785733385 edited: false body: Why don’t people take out their btc from cold card after first wave comment: p1e3djc parent: t3_1ve28wl author: letsmeet123456 created_utc: 1785734113 edited: false body: This was 100% an inside job comment: p1e3i9wExcerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
The Reddit thread gained 1 new comment.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 8 lines
edited: false body: You know how you get that sunken feeling when you misplaced something, like your phone... This would induce a stroke. + +comment: p1oj393 +parent: t1_p1ekaes +author: Ok_Option_3 +created_utc: 1785861725 +edited: false +body: +Not really. Selling these won't be simple.Extracted text as captured
post: 1ve28wl author: JesC929 created_utc: 1785728255 title: 4th Wave Reported - 389 BTC Hacked body: Sadly saying that a 4th wave has now been reported in the ongoing sad ColdCard debacle. comment: p1dswdd parent: t3_1ve28wl author: conzor343 created_utc: 1785729505 edited: false body: Some how they only took 86,146 sats from me had a lot more there dunno why it didn’t all go but my funds are now safely off coldcard comment: p1dteba parent: t1_p1dswdd author: Badmoodsbear created_utc: 1785729711 edited: false body: Wow that is insanely lucky. comment: p1e1t0t parent: t3_1ve28wl author: levelup1by1 created_utc: 1785733385 edited: false body: Why don’t people take out their btc from cold card after first wave comment: p1e3djc parent: t3_1ve28wl author: letsmeet123456 created_utc: 1785734113 edited: false body: This was 100% an inside job comment: p1e3i9wExcerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
2 new Reddit comments were posted, both by Guava_Poppa, describing the emotional impact of a loss.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 16 lines
lol ok child who doesn't understand the difference between corruption and conspiracy. + +comment: p1o4cqh +parent: t1_p1fyepd +author: Guava_Poppa +created_utc: 1785858009 +edited: false +body: +Yeah. But that FTX debacle has me sweating aswell. 😅 + +comment: p1o54gc +parent: t1_p1im4cm +author: Guava_Poppa +created_utc: 1785858205 +edited: false +body: +You know how you get that sunken feeling when you misplaced something, like your phone... This would induce a stroke.Extracted text as captured
post: 1ve28wl author: JesC929 created_utc: 1785728255 title: 4th Wave Reported - 389 BTC Hacked body: Sadly saying that a 4th wave has now been reported in the ongoing sad ColdCard debacle. comment: p1dswdd parent: t3_1ve28wl author: conzor343 created_utc: 1785729505 edited: false body: Some how they only took 86,146 sats from me had a lot more there dunno why it didn’t all go but my funds are now safely off coldcard comment: p1dteba parent: t1_p1dswdd author: Badmoodsbear created_utc: 1785729711 edited: false body: Wow that is insanely lucky. comment: p1e1t0t parent: t3_1ve28wl author: levelup1by1 created_utc: 1785733385 edited: false body: Why don’t people take out their btc from cold card after first wave comment: p1e3djc parent: t3_1ve28wl author: letsmeet123456 created_utc: 1785734113 edited: false body: This was 100% an inside job comment: p1e3i9wExcerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
4 new Reddit comments were posted, including Icy_Giraffe_21,Mobe-E-Duck,dj_destroyer.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 34 lines
edited: false body: Oy. It would be like the scammer has monthly subscribers. Just a few people in the dark sending their compromised wallets money every month and having no clue. This is so upsetting to think about. + +comment: p1mnvts +parent: t1_p1dswdd +author: Icy_Giraffe_21 +created_utc: 1785842601 +edited: false +body: +Someone else posted a screenshot shot of .7 BTC being drained and it was like 7-8 small transactions also, very odd. + +comment: p1mrbfr +parent: t1_p1j5b90 +author: Mobe-E-Duck +created_utc: 1785843870 +edited: false +body: +One thing I use is security hygiene which dictates not disclosing the specifics. + +comment: p1n1vls +parent: t1_p1mrbfr +author: dj_destroyer +created_utc: 1785847423 +edited: false +body: +lol ok + +comment: p1n8qzb +parent: t1_p1k9bu6 +author: GentlemenHODL +created_utc: 1785849500 +edited: false +body: +lol ok child who doesn't understand the difference between corruption and conspiracy. + +Extracted text as captured
post: 1ve28wl author: JesC929 created_utc: 1785728255 title: 4th Wave Reported - 389 BTC Hacked body: Sadly saying that a 4th wave has now been reported in the ongoing sad ColdCard debacle. comment: p1dswdd parent: t3_1ve28wl author: conzor343 created_utc: 1785729505 edited: false body: Some how they only took 86,146 sats from me had a lot more there dunno why it didn’t all go but my funds are now safely off coldcard comment: p1dteba parent: t1_p1dswdd author: Badmoodsbear created_utc: 1785729711 edited: false body: Wow that is insanely lucky. comment: p1e1t0t parent: t3_1ve28wl author: levelup1by1 created_utc: 1785733385 edited: false body: Why don’t people take out their btc from cold card after first wave comment: p1e3djc parent: t3_1ve28wl author: letsmeet123456 created_utc: 1785734113 edited: false body: This was 100% an inside job comment: p1e3i9wExcerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 0 lines
Extracted text as captured
post: 1ve28wl author: JesC929 created_utc: 1785728255 title: 4th Wave Reported - 389 BTC Hacked body: Sadly saying that a 4th wave has now been reported in the ongoing sad ColdCard debacle. comment: p1dswdd parent: t3_1ve28wl author: conzor343 created_utc: 1785729505 edited: false body: Some how they only took 86,146 sats from me had a lot more there dunno why it didn’t all go but my funds are now safely off coldcard comment: p1dteba parent: t1_p1dswdd author: Badmoodsbear created_utc: 1785729711 edited: false body: Wow that is insanely lucky. comment: p1e1t0t parent: t3_1ve28wl author: levelup1by1 created_utc: 1785733385 edited: false body: Why don’t people take out their btc from cold card after first wave comment: p1e3djc parent: t3_1ve28wl author: letsmeet123456 created_utc: 1785734113 edited: false body: This was 100% an inside job comment: p1e3i9wExcerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
1 presentation-noise difference. Sidebar, ticker and other page chrome churn that our review classified as not being a change to what the source says.
- +0 -8 The same eight-line 'That is what I was thinking' comment that the previous capture added has dropped out again, so the change is Reddit ranking or hydration churn rather than a source deletion.
The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.
Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.
Compare the screenshot or a quotation against the original while it is available.