COLDCARD RNG incident the public record, collected and explained
Informational only, and this site never asks for your seed words. details

Informational only. This is an open source collection of what others have published about the incident, together with an explanation of it. It is not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite. Material is attributed and quoted as published; where sources disagree their scenarios are kept separate with their assumptions rather than reconciled into one answer. Everything is meant to be checked against the linked evidence rather than taken on trust. Act on your own judgement about a particular situation. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it, and contributions containing recovery words or private keys are not accepted.

r/Bitcoin: victim whose drained coins sit apart from the known consolidation set

reddit-unconsolidated-drain-account

https://www.reddit.com/r/Bitcoin/comments/1veo132/coldcard_loss_question/

Organisation
reddit
Evidence role
Community discussion
Published
not established
Source changes
0
Detected differences
0
Unreviewed
0
Copies held
1

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .

  1. Earliest copy held Current
    seen · Captured here 1,432 chars
    Extracted text as captured 
    post: 1veo132
author: rkavanau
created_utc: 1785786822
title: Coldcard Loss Question
body:
I had 5 Coldcard addresses that were drained on 7/31. They all went to a single address in that transaction. Actually to a first address and then a second where they are currently sitting. However, it is just my coins there and they not combined with a larger set of others that I keep seeing references to. Is it likely there were multiple people exploiting using the same weakness, or was this the case with others?

Happy to post tx-id or address, but when tried previously my posts kept getting blocked or removed. 

comment: p1ii25w
parent: t3_1veo132
author: Powerful_Quarter691
created_utc: 1785787161
edited: false
body:
High chance… once the vulnerability was out multiple people joined and tried their chances to scoop up everything else… also this thing has happened in 2022 too , albeit to small number of people and apparently Coinkite or whatever this piece of shit company is called ignored it and blamed their customers. 

comment: p1ivans
parent: t3_1veo132
author: SpareEconomy1849
created_utc: 1785790650
edited: false
body:
Not sure about others but I'm really not surprised. Within hours the exploit was fully public and millions of people around the world suddenly had the ability to join in on the theft. It just takes a cold heart, a little processing power and some technical ability (not too hard with AI nowadays)
How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.