COLDCARD RNG incident the public record, collected and explained
Informational only, and this site never asks for your seed words. details

Informational only. This is an open source collection of what others have published about the incident, together with an explanation of it. It is not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite. Material is attributed and quoted as published; where sources disagree their scenarios are kept separate with their assumptions rather than reconciled into one answer. Everything is meant to be checked against the linked evidence rather than taken on trust. Act on your own judgement about a particular situation. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it, and contributions containing recovery words or private keys are not accepted.

Source of the community holdings tracker

samsamskies-tracker-readme

https://raw.githubusercontent.com/SamSamskies/coldcard-hack-tracker/main/README.md

Latest reviewed change

source content difference between and

The README was rewritten to describe a static dashboard fed entirely by a GitHub Actions cron snapshot, replacing the previous live browser-polling model for core vault balances.

seen +19 -18 full history below
 # Coldcard Hack Tracker
-Live single-page dashboard for Bitcoin held after Coldcard seed-entropy sweeps since July 2026.
-Monitors consolidation vaults across named clusters (Galaxy Waves 1–3 plus later community waves). **Core vaults** (Waves 1–2 and small community holdings) are polled live in the browser via the public [mempool.space](https://mempool.space) API. **Wave 3** balances come from `public/snapshot.json`, refreshed by a GitHub Actions cron about every 6 hours — so visitors do not fan out dozens of explorer requests.
+Static dashboard for Bitcoin held after Coldcard seed-entropy sweeps since July 2026.
+Monitors consolidation vaults across named clusters (Galaxy Waves 1–3 plus later community waves). All balances and the movement feed come from `public/snapshot.json`, refreshed by a GitHub Actions cron about every 6 hours — visitors do not hit public explorers.
 ## Develop
 ```bash
 npm install

First lines only. The complete diff is in the timeline below.

Organisation
SamSamskies
Evidence role
Chain monitor
Published
2026-07-31
Source changes
5
Detected differences
5
Unreviewed
0
Copies held
6

The published source behind the tracker dashboard this archive already captures, which makes the deployed page auditable rather than opaque. Watches public addresses through public block-explorer APIs and takes no wallet material from the reader. MIT licensed with a test suite; its watch set is hardcoded from public reports rather than derived independently.

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .

  1. source content difference between and Current source content +19 -18

    The README was rewritten to describe a static dashboard fed entirely by a GitHub Actions cron snapshot, replacing the previous live browser-polling model for core vault balances.

    seen · Captured here 3,332 chars
    What changed from the previous capture 37 lines
     # Coldcard Hack Tracker
    -Live single-page dashboard for Bitcoin held after Coldcard seed-entropy sweeps since July 2026.
    -Monitors consolidation vaults across named clusters (Galaxy Waves 1–3 plus later community waves). **Core vaults** (Waves 1–2 and small community holdings) are polled live in the browser via the public [mempool.space](https://mempool.space) API. **Wave 3** balances come from `public/snapshot.json`, refreshed by a GitHub Actions cron about every 6 hours — so visitors do not fan out dozens of explorer requests.
    +Static dashboard for Bitcoin held after Coldcard seed-entropy sweeps since July 2026.
    +Monitors consolidation vaults across named clusters (Galaxy Waves 1–3 plus later community waves). All balances and the movement feed come from `public/snapshot.json`, refreshed by a GitHub Actions cron about every 6 hours — visitors do not hit public explorers.
     ## Develop
     ```bash
     npm install
     ## Data sources
     | Data | Source |
     |------|--------|
    -| Core balances & txs (live) | mempool `/api/address/{addr}` |
    -| Wave 3 balances | `/snapshot.json` (cron) |
    -| BTC/USD | `/api/v1/prices` (+ snapshot) |
    +| Holdings & movements | `/snapshot.json` (cron) |
    +| BTC/USD | snapshot `usdPrice` |
     | Incident facts | Galaxy Research + community cluster reports (static) |
    -No API key is needed for the dashboard. Core vaults refresh about every 5 minutes; the Wave 3 snapshot is re-read about every 15 minutes.
    +No API key is needed for the dashboard. The browser re-reads `/snapshot.json` on load, on tab focus, and about every 15 minutes while the tab is visible.
     Optional local research: put `BLOCKCHAIR_API_KEY` in a gitignored `.env` for faster tip wave scouts (`scripts/scan-new-waves.py --blockchair`) and batch balance checks (`scripts/blockchair-balances.py`). Estimate request points and confirm before spending quota; **do not** use that key in the snapshot cron.
     ### Balance snapshot
     ```bash
     npm run snapshot
     ```
    -Writes `public/snapshot.json` (all watched holdings + movements for vaults that look spent). On `main`, [`.github/workflows/snapshot.yml`](.github/workflows/snapshot.yml) runs this on a schedule and commits the file so static hosts redeploy with fresh Wave 3 numbers. Esplora-only by design.
    +Writes `public/snapshot.json` (all watched holdings + movements for vaults that look spent). On `main`, [`.github/workflows/snapshot.yml`](.github/workflows/snapshot.yml) runs this on a schedule and commits the file so static hosts redeploy with fresh numbers. Esplora-only by design.
     ### Tip wave scout
     ```bash
     python3 scripts/scan-new-waves.py --no-escalate --blockchair   # needs .env key
     Scouts the last 3 tip blocks for Coldcard-like 1-vout fee clusters. See `.cursor/skills/new-wave-scan/SKILL.md`.
     ### Movement alerts
     Use the **Alerts** toggle in the header for browser notifications when a new
    -outbound spend appears (holdings or followed hops). Preference is stored in
    -`localStorage`; the tab must stay open for polling to continue.
    +outbound spend appears in the snapshot (holdings or followed hops). This is
    +not live chain — the cron is about every 6 hours. Preference is stored in
    +`localStorage`. Notifications only fire while the tab is open (including after
    +a snapshot re-read).
     ### Explorer mirrors
    -Some networks, VPNs, and DNS filters block `mempool.space`, which makes every
    -request fail in the browser. The app probes hosts in order and reuses the first
    -one that answers:
    -1. `mempool.space`
    -2. `mempool.emzy.de`
    -3. `mempool.bitaroo.net`
    -The footer shows which host served the current data. Edit `MEMPOOL_HOSTS` in
    -[src/data/incident.ts](src/data/incident.ts) to add your own instance.
    +The snapshot cron probes Esplora hosts in this order (see `HOSTS` in
    +`scripts/build-snapshot.mjs`):
    +1. `mempool.bitaroo.net`
    +2. `mempool.space`
    +3. `mempool.emzy.de`
    +Address and transaction links in the UI default to `mempool.space`. Edit
    +`MEMPOOL_HOSTS` in [src/data/incident.ts](src/data/incident.ts) to change
    +link targets.
     ### Hop following
    -When a holding address spends reported consolidation, the tracker follows the
    +When a holding address spends reported consolidation, the snapshot builder follows the
     largest destinations (up to hop 2, ignoring dust under 0.01 BTC) and lists those
     outbound spends in the movement feed. Still-held % stays based on the watched
     holding addresses only.
    
    Extracted text as captured
    # Coldcard Hack Tracker
    Static dashboard for Bitcoin held after Coldcard seed-entropy sweeps since July 2026.
    Monitors consolidation vaults across named clusters (Galaxy Waves 1–3 plus later community waves). All balances and the movement feed come from `public/snapshot.json`, refreshed by a GitHub Actions cron about every 6 hours — visitors do not hit public explorers.
    ## Develop
    ```bash
    npm install
    npm run dev
    ```
    Open the URL Vite prints (usually `http://localhost:5173`).
    ```bash
    npm test
    ```
    Runs the Vitest unit suite (formatters, outbound/hop logic, incident data invariants).
    ## Build / deploy
    ```bash
    npm run build
    npm run preview
    ```
    `dist/` is a static site — deploy to Vercel, Netlify, Cloudflare Pages, or any static host.
    ## Data sources
    | Data | Source |
    |------|--------|
    | Holdings & movements | `/snapshot.json` (cron) |
    | BTC/USD | snapshot `usdPrice` |
    | Incident facts | Galaxy Research + community cluster reports (static) |
    No API key is needed for the dashboard. The browser re-reads `/snapshot.json` on load, on tab focus, and about every 15 minutes while the tab is visible.
    Optional local research: put `BLOCKCHAIR_API_KEY` in a gitignored `.env` for faster tip wave scouts (`scripts/scan-new-waves.py --blockchair`) and batch balance checks (`scripts/blockchair-balances.py`). Estimate request points and confirm before spending quota; **do not** use that key in the snapshot cron.
    ### Balance snapshot
    ```bash
    npm run snapshot
    ```
    Writes `public/snapshot.json` (all watched holdings + movements for vaults that look spent). On `main`, [`.github/workflows/snapshot.yml`](.github/workflows/snapshot.yml) runs this on a schedule and commits the file so static hosts redeploy with fresh numbers. Esplora-only by design.
    ### Tip wave scout
    ```bash
    python3 scripts/scan-new-waves.py --no-escalate --blockchair   # needs .env key
    python3 scripts/scan-new-waves.py --no-escalate                # Esplora fallback
    ```
    Scouts the last 3 tip blocks for Coldcard-like 1-vout fee clusters. See `.cursor/skills/new-wave-scan/SKILL.md`.
    ### Movement alerts
    Use the **Alerts** toggle in the header for browser notifications when a new

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  2. source content difference between and source content +2 -2

    The README changed its documented refresh intervals: core vaults from 60 seconds to 5 minutes, Wave 3 snapshot generation from about 2 hours to 6 hours, and snapshot re-reads from 5 minutes to 15 minutes.

    seen · Captured here 3,495 chars
    What changed from the previous capture 4 lines
     # Coldcard Hack Tracker
     Live single-page dashboard for Bitcoin held after Coldcard seed-entropy sweeps since July 2026.
    -Monitors consolidation vaults across named clusters (Galaxy Waves 1–3 plus later community waves). **Core vaults** (Waves 1–2 and small community holdings) are polled live in the browser via the public [mempool.space](https://mempool.space) API. **Wave 3** balances come from `public/snapshot.json`, refreshed by a GitHub Actions cron about every 2 hours — so visitors do not fan out dozens of explorer requests.
    +Monitors consolidation vaults across named clusters (Galaxy Waves 1–3 plus later community waves). **Core vaults** (Waves 1–2 and small community holdings) are polled live in the browser via the public [mempool.space](https://mempool.space) API. **Wave 3** balances come from `public/snapshot.json`, refreshed by a GitHub Actions cron about every 6 hours — so visitors do not fan out dozens of explorer requests.
     ## Develop
     ```bash
     npm install
     | Wave 3 balances | `/snapshot.json` (cron) |
     | BTC/USD | `/api/v1/prices` (+ snapshot) |
     | Incident facts | Galaxy Research + community cluster reports (static) |
    -No API key is needed for the dashboard. Core vaults refresh about every 60 seconds; the Wave 3 snapshot is re-read about every 5 minutes.
    +No API key is needed for the dashboard. Core vaults refresh about every 5 minutes; the Wave 3 snapshot is re-read about every 15 minutes.
     Optional local research: put `BLOCKCHAIR_API_KEY` in a gitignored `.env` for faster tip wave scouts (`scripts/scan-new-waves.py --blockchair`) and batch balance checks (`scripts/blockchair-balances.py`). Estimate request points and confirm before spending quota; **do not** use that key in the snapshot cron.
     ### Balance snapshot
     ```bash
    
    Extracted text as captured
    # Coldcard Hack Tracker
    Live single-page dashboard for Bitcoin held after Coldcard seed-entropy sweeps since July 2026.
    Monitors consolidation vaults across named clusters (Galaxy Waves 1–3 plus later community waves). **Core vaults** (Waves 1–2 and small community holdings) are polled live in the browser via the public [mempool.space](https://mempool.space) API. **Wave 3** balances come from `public/snapshot.json`, refreshed by a GitHub Actions cron about every 6 hours — so visitors do not fan out dozens of explorer requests.
    ## Develop
    ```bash
    npm install
    npm run dev
    ```
    Open the URL Vite prints (usually `http://localhost:5173`).
    ```bash
    npm test
    ```
    Runs the Vitest unit suite (formatters, outbound/hop logic, incident data invariants).
    ## Build / deploy
    ```bash
    npm run build
    npm run preview
    ```
    `dist/` is a static site — deploy to Vercel, Netlify, Cloudflare Pages, or any static host.
    ## Data sources
    | Data | Source |
    |------|--------|
    | Core balances & txs (live) | mempool `/api/address/{addr}` |
    | Wave 3 balances | `/snapshot.json` (cron) |
    | BTC/USD | `/api/v1/prices` (+ snapshot) |
    | Incident facts | Galaxy Research + community cluster reports (static) |
    No API key is needed for the dashboard. Core vaults refresh about every 5 minutes; the Wave 3 snapshot is re-read about every 15 minutes.
    Optional local research: put `BLOCKCHAIR_API_KEY` in a gitignored `.env` for faster tip wave scouts (`scripts/scan-new-waves.py --blockchair`) and batch balance checks (`scripts/blockchair-balances.py`). Estimate request points and confirm before spending quota; **do not** use that key in the snapshot cron.
    ### Balance snapshot
    ```bash
    npm run snapshot
    ```
    Writes `public/snapshot.json` (all watched holdings + movements for vaults that look spent). On `main`, [`.github/workflows/snapshot.yml`](.github/workflows/snapshot.yml) runs this on a schedule and commits the file so static hosts redeploy with fresh Wave 3 numbers. Esplora-only by design.
    ### Tip wave scout
    ```bash
    python3 scripts/scan-new-waves.py --no-escalate --blockchair   # needs .env key
    python3 scripts/scan-new-waves.py --no-escalate                # Esplora fallback
    ```
    Scouts the last 3 tip blocks for Coldcard-like 1-vout fee clusters. See `.cursor/skills/new-wave-scan/SKILL.md`.
    ### Movement alerts

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  3. source content difference between and source content +1 -1

    The README changed the Wave 3 snapshot refresh interval from about every 15 minutes to about every 2 hours.

    seen · Captured here 3,495 chars
    What changed from the previous capture 2 lines
     # Coldcard Hack Tracker
     Live single-page dashboard for Bitcoin held after Coldcard seed-entropy sweeps since July 2026.
    -Monitors consolidation vaults across named clusters (Galaxy Waves 1–3 plus later community waves). **Core vaults** (Waves 1–2 and small community holdings) are polled live in the browser via the public [mempool.space](https://mempool.space) API. **Wave 3** balances come from `public/snapshot.json`, refreshed by a GitHub Actions cron about every 15 minutes — so visitors do not fan out dozens of explorer requests.
    +Monitors consolidation vaults across named clusters (Galaxy Waves 1–3 plus later community waves). **Core vaults** (Waves 1–2 and small community holdings) are polled live in the browser via the public [mempool.space](https://mempool.space) API. **Wave 3** balances come from `public/snapshot.json`, refreshed by a GitHub Actions cron about every 2 hours — so visitors do not fan out dozens of explorer requests.
     ## Develop
     ```bash
     npm install
    
    Extracted text as captured
    # Coldcard Hack Tracker
    Live single-page dashboard for Bitcoin held after Coldcard seed-entropy sweeps since July 2026.
    Monitors consolidation vaults across named clusters (Galaxy Waves 1–3 plus later community waves). **Core vaults** (Waves 1–2 and small community holdings) are polled live in the browser via the public [mempool.space](https://mempool.space) API. **Wave 3** balances come from `public/snapshot.json`, refreshed by a GitHub Actions cron about every 2 hours — so visitors do not fan out dozens of explorer requests.
    ## Develop
    ```bash
    npm install
    npm run dev
    ```
    Open the URL Vite prints (usually `http://localhost:5173`).
    ```bash
    npm test
    ```
    Runs the Vitest unit suite (formatters, outbound/hop logic, incident data invariants).
    ## Build / deploy
    ```bash
    npm run build
    npm run preview
    ```
    `dist/` is a static site — deploy to Vercel, Netlify, Cloudflare Pages, or any static host.
    ## Data sources
    | Data | Source |
    |------|--------|
    | Core balances & txs (live) | mempool `/api/address/{addr}` |
    | Wave 3 balances | `/snapshot.json` (cron) |
    | BTC/USD | `/api/v1/prices` (+ snapshot) |
    | Incident facts | Galaxy Research + community cluster reports (static) |
    No API key is needed for the dashboard. Core vaults refresh about every 60 seconds; the Wave 3 snapshot is re-read about every 5 minutes.
    Optional local research: put `BLOCKCHAIR_API_KEY` in a gitignored `.env` for faster tip wave scouts (`scripts/scan-new-waves.py --blockchair`) and batch balance checks (`scripts/blockchair-balances.py`). Estimate request points and confirm before spending quota; **do not** use that key in the snapshot cron.
    ### Balance snapshot
    ```bash
    npm run snapshot
    ```
    Writes `public/snapshot.json` (all watched holdings + movements for vaults that look spent). On `main`, [`.github/workflows/snapshot.yml`](.github/workflows/snapshot.yml) runs this on a schedule and commits the file so static hosts redeploy with fresh Wave 3 numbers. Esplora-only by design.
    ### Tip wave scout
    ```bash
    python3 scripts/scan-new-waves.py --no-escalate --blockchair   # needs .env key
    python3 scripts/scan-new-waves.py --no-escalate                # Esplora fallback
    ```
    Scouts the last 3 tip blocks for Coldcard-like 1-vout fee clusters. See `.cursor/skills/new-wave-scan/SKILL.md`.
    ### Movement alerts

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  4. source content difference between and source content +9 -2

    The tracker README added optional Blockchair-assisted research instructions and a tip-wave scout section.

    seen · Captured here 3,498 chars
    What changed from the previous capture 11 lines
     | Wave 3 balances | `/snapshot.json` (cron) |
     | BTC/USD | `/api/v1/prices` (+ snapshot) |
     | Incident facts | Galaxy Research + community cluster reports (static) |
    -No API key is needed. Core vaults refresh about every 60 seconds; the Wave 3 snapshot is re-read about every 5 minutes.
    +No API key is needed for the dashboard. Core vaults refresh about every 60 seconds; the Wave 3 snapshot is re-read about every 5 minutes.
    +Optional local research: put `BLOCKCHAIR_API_KEY` in a gitignored `.env` for faster tip wave scouts (`scripts/scan-new-waves.py --blockchair`) and batch balance checks (`scripts/blockchair-balances.py`). Estimate request points and confirm before spending quota; **do not** use that key in the snapshot cron.
     ### Balance snapshot
     ```bash
     npm run snapshot
     ```
    -Writes `public/snapshot.json` (all watched holdings + movements for vaults that look spent). On `main`, [`.github/workflows/snapshot.yml`](.github/workflows/snapshot.yml) runs this on a schedule and commits the file so static hosts redeploy with fresh Wave 3 numbers.
    +Writes `public/snapshot.json` (all watched holdings + movements for vaults that look spent). On `main`, [`.github/workflows/snapshot.yml`](.github/workflows/snapshot.yml) runs this on a schedule and commits the file so static hosts redeploy with fresh Wave 3 numbers. Esplora-only by design.
    +### Tip wave scout
    +```bash
    +python3 scripts/scan-new-waves.py --no-escalate --blockchair   # needs .env key
    +python3 scripts/scan-new-waves.py --no-escalate                # Esplora fallback
    +```
    +Scouts the last 3 tip blocks for Coldcard-like 1-vout fee clusters. See `.cursor/skills/new-wave-scan/SKILL.md`.
     ### Movement alerts
     Use the **Alerts** toggle in the header for browser notifications when a new
     outbound spend appears (holdings or followed hops). Preference is stored in
    
    Extracted text as captured
    # Coldcard Hack Tracker
    Live single-page dashboard for Bitcoin held after Coldcard seed-entropy sweeps since July 2026.
    Monitors consolidation vaults across named clusters (Galaxy Waves 1–3 plus later community waves). **Core vaults** (Waves 1–2 and small community holdings) are polled live in the browser via the public [mempool.space](https://mempool.space) API. **Wave 3** balances come from `public/snapshot.json`, refreshed by a GitHub Actions cron about every 15 minutes — so visitors do not fan out dozens of explorer requests.
    ## Develop
    ```bash
    npm install
    npm run dev
    ```
    Open the URL Vite prints (usually `http://localhost:5173`).
    ```bash
    npm test
    ```
    Runs the Vitest unit suite (formatters, outbound/hop logic, incident data invariants).
    ## Build / deploy
    ```bash
    npm run build
    npm run preview
    ```
    `dist/` is a static site — deploy to Vercel, Netlify, Cloudflare Pages, or any static host.
    ## Data sources
    | Data | Source |
    |------|--------|
    | Core balances & txs (live) | mempool `/api/address/{addr}` |
    | Wave 3 balances | `/snapshot.json` (cron) |
    | BTC/USD | `/api/v1/prices` (+ snapshot) |
    | Incident facts | Galaxy Research + community cluster reports (static) |
    No API key is needed for the dashboard. Core vaults refresh about every 60 seconds; the Wave 3 snapshot is re-read about every 5 minutes.
    Optional local research: put `BLOCKCHAIR_API_KEY` in a gitignored `.env` for faster tip wave scouts (`scripts/scan-new-waves.py --blockchair`) and batch balance checks (`scripts/blockchair-balances.py`). Estimate request points and confirm before spending quota; **do not** use that key in the snapshot cron.
    ### Balance snapshot
    ```bash
    npm run snapshot
    ```
    Writes `public/snapshot.json` (all watched holdings + movements for vaults that look spent). On `main`, [`.github/workflows/snapshot.yml`](.github/workflows/snapshot.yml) runs this on a schedule and commits the file so static hosts redeploy with fresh Wave 3 numbers. Esplora-only by design.
    ### Tip wave scout
    ```bash
    python3 scripts/scan-new-waves.py --no-escalate --blockchair   # needs .env key
    python3 scripts/scan-new-waves.py --no-escalate                # Esplora fallback
    ```
    Scouts the last 3 tip blocks for Coldcard-like 1-vout fee clusters. See `.cursor/skills/new-wave-scan/SKILL.md`.
    ### Movement alerts

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  5. source content difference between and source content +10 -4

    The tracker README now documents a two-tier data model: core vaults polled live in the browser while Wave 3 balances come from public/snapshot.json, refreshed by a GitHub Actions cron roughly every 15 minutes, with a new Balance snapshot section and updated data-sources table.

    seen · Captured here 2,841 chars
    What changed from the previous capture 14 lines
     # Coldcard Hack Tracker
     Live single-page dashboard for Bitcoin held after Coldcard seed-entropy sweeps since July 2026.
    -Monitors consolidation vaults across named clusters (Galaxy’s July 30 fingerprint set plus later reported waves) via the public [mempool.space](https://mempool.space) API (no API key). Shows still-held %, BTC/USD value, per-address status, and outbound spends when funds move. Clusters may be different operators.
    +Monitors consolidation vaults across named clusters (Galaxy Waves 1–3 plus later community waves). **Core vaults** (Waves 1–2 and small community holdings) are polled live in the browser via the public [mempool.space](https://mempool.space) API. **Wave 3** balances come from `public/snapshot.json`, refreshed by a GitHub Actions cron about every 15 minutes — so visitors do not fan out dozens of explorer requests.
     ## Develop
     ```bash
     npm install
     ## Data sources
     | Data | Source |
     |------|--------|
    -| Address balances & txs | `/api/address/{addr}` |
    -| BTC/USD | `/api/v1/prices` |
    +| Core balances & txs (live) | mempool `/api/address/{addr}` |
    +| Wave 3 balances | `/snapshot.json` (cron) |
    +| BTC/USD | `/api/v1/prices` (+ snapshot) |
     | Incident facts | Galaxy Research + community cluster reports (static) |
    -No API key is needed. The UI refreshes about every 60 seconds.
    +No API key is needed. Core vaults refresh about every 60 seconds; the Wave 3 snapshot is re-read about every 5 minutes.
    +### Balance snapshot
    +```bash
    +npm run snapshot
    +```
    +Writes `public/snapshot.json` (all watched holdings + movements for vaults that look spent). On `main`, [`.github/workflows/snapshot.yml`](.github/workflows/snapshot.yml) runs this on a schedule and commits the file so static hosts redeploy with fresh Wave 3 numbers.
     ### Movement alerts
     Use the **Alerts** toggle in the header for browser notifications when a new
     outbound spend appears (holdings or followed hops). Preference is stored in
    
    Extracted text as captured
    # Coldcard Hack Tracker
    Live single-page dashboard for Bitcoin held after Coldcard seed-entropy sweeps since July 2026.
    Monitors consolidation vaults across named clusters (Galaxy Waves 1–3 plus later community waves). **Core vaults** (Waves 1–2 and small community holdings) are polled live in the browser via the public [mempool.space](https://mempool.space) API. **Wave 3** balances come from `public/snapshot.json`, refreshed by a GitHub Actions cron about every 15 minutes — so visitors do not fan out dozens of explorer requests.
    ## Develop
    ```bash
    npm install
    npm run dev
    ```
    Open the URL Vite prints (usually `http://localhost:5173`).
    ```bash
    npm test
    ```
    Runs the Vitest unit suite (formatters, outbound/hop logic, incident data invariants).
    ## Build / deploy
    ```bash
    npm run build
    npm run preview
    ```
    `dist/` is a static site — deploy to Vercel, Netlify, Cloudflare Pages, or any static host.
    ## Data sources
    | Data | Source |
    |------|--------|
    | Core balances & txs (live) | mempool `/api/address/{addr}` |
    | Wave 3 balances | `/snapshot.json` (cron) |
    | BTC/USD | `/api/v1/prices` (+ snapshot) |
    | Incident facts | Galaxy Research + community cluster reports (static) |
    No API key is needed. Core vaults refresh about every 60 seconds; the Wave 3 snapshot is re-read about every 5 minutes.
    ### Balance snapshot
    ```bash
    npm run snapshot
    ```
    Writes `public/snapshot.json` (all watched holdings + movements for vaults that look spent). On `main`, [`.github/workflows/snapshot.yml`](.github/workflows/snapshot.yml) runs this on a schedule and commits the file so static hosts redeploy with fresh Wave 3 numbers.
    ### Movement alerts
    Use the **Alerts** toggle in the header for browser notifications when a new
    outbound spend appears (holdings or followed hops). Preference is stored in
    `localStorage`; the tab must stay open for polling to continue.
    ### Explorer mirrors
    Some networks, VPNs, and DNS filters block `mempool.space`, which makes every
    request fail in the browser. The app probes hosts in order and reuses the first
    one that answers:

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  6. Earliest copy held
    seen · Captured here 2,293 chars
    Extracted text as captured
    # Coldcard Hack Tracker
    Live single-page dashboard for Bitcoin held after Coldcard seed-entropy sweeps since July 2026.
    Monitors consolidation vaults across named clusters (Galaxy’s July 30 fingerprint set plus later reported waves) via the public [mempool.space](https://mempool.space) API (no API key). Shows still-held %, BTC/USD value, per-address status, and outbound spends when funds move. Clusters may be different operators.
    ## Develop
    ```bash
    npm install
    npm run dev
    ```
    Open the URL Vite prints (usually `http://localhost:5173`).
    ```bash
    npm test
    ```
    Runs the Vitest unit suite (formatters, outbound/hop logic, incident data invariants).
    ## Build / deploy
    ```bash
    npm run build
    npm run preview
    ```
    `dist/` is a static site — deploy to Vercel, Netlify, Cloudflare Pages, or any static host.
    ## Data sources
    | Data | Source |
    |------|--------|
    | Address balances & txs | `/api/address/{addr}` |
    | BTC/USD | `/api/v1/prices` |
    | Incident facts | Galaxy Research + community cluster reports (static) |
    No API key is needed. The UI refreshes about every 60 seconds.
    ### Movement alerts
    Use the **Alerts** toggle in the header for browser notifications when a new
    outbound spend appears (holdings or followed hops). Preference is stored in
    `localStorage`; the tab must stay open for polling to continue.
    ### Explorer mirrors
    Some networks, VPNs, and DNS filters block `mempool.space`, which makes every
    request fail in the browser. The app probes hosts in order and reuses the first
    one that answers:
    1. `mempool.space`
    2. `mempool.emzy.de`
    3. `mempool.bitaroo.net`
    The footer shows which host served the current data. Edit `MEMPOOL_HOSTS` in
    [src/data/incident.ts](src/data/incident.ts) to add your own instance.
    ### Hop following

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.