369 Guard

Update

Permalink for this incident. Same content as the News feed. Use Share to post it.

← All news

Coldcard seed advisory widened; ~594 BTC single-sig sweep still unproven link

highBitcoincustodyUpdated

Update · 2026-08-15

Galaxy: ~1,779 BTC confirmed; sweeps look quiet after 6 Aug

7 M) after speaking with 190+ victims, across more than 8,600 addresses. Confirmed attacker waves and footprints show no activity after 6 Aug.

” About 1,531 BTC still sits in attacker addresses; ~246 BTC has been moved (majority via CoinJoin).

Firmware update still does not repair an already-weak seed: generate a new seed on fixed firmware and migrate calmly if you still hold on single-sig Coldcard addresses.

A higher ~2,417 BTC / ~$153 M figure includes unconfirmed Wave 4 and other medium-confidence footprints: treat that as Real-overstated until Galaxy promotes it to the confirmed tally.

Update · 2026-08-08

Galaxy ~1,719 BTC (~$111 M) confirmed class; multi-attacker + early laundering

7–9 Aug 2026 window: Galaxy Research high-confidence tracking cites ~1,719 BTC (~$111 M); wider desk estimates still range toward ~$130 M as enumeration continues.

At least ~15 distinct attackers reported. Limited laundering observed (Wasabi-class BTC + Tornado Cash ETH).

Coinkite migration guidance unchanged: fixed firmware exists, but updating alone does not repair an already-weak seed: generate a new seed on fixed firmware and migrate calmly.

Treat viral max-$ totals as Real-overstated until settled; prefer Galaxy’s confirmed kernel for board language.

Update · 2026-08-03

Fourth wave: ~449 BTC class; cumulative still climbing

7 BTC from ~709 suspected addresses). RBF tip for unconfirmed spends only: once confirmed, migrate. 8k BTC class: that sum is research tracking, not a Coinkite-confirmed final.

Firmware update still does not fix an already-weak seed; generate new seed on fixed firmware and move calmly.

Update · 2026-08-02

Third wave: +~208 BTC; Galaxy total ~1,367 BTC / 4,585 addresses

73 BTC moved. 05 BTC from ~4,585 addresses. Still the same enumeration campaign class: figures keep climbing as more bags are found.

Review Coinkite’s official seed guidance; firmware alone does not repair an already-weak seed. Treat press “hack” shorthand and max-$ headlines with a Verify bar until causation vs total is settled.

Update · 2026-08-02

Second sweep wave: Galaxy tracking ~1,158 BTC

1–2 Aug 2026: Galaxy Research mapped a second wave attributed to the same operator class.

Combined tracking ~1,158 BTC (~$70–75M class) from ~2,673 addresses across multiple attacker wallets (CoinDesk earlier expansion ~1,083 BTC / 1,196 wallets; some desks still climbing toward ~1,367 BTC).

Firmware patch does not fix an already-weak seed: new seed + migrate.

Causal “every sat = this RNG bug” remains research-attribution (Block/Galaxy), not a Coinkite courtroom proof: treat viral max $ as Real-overstated until settled.

Enumeration is still running; don’t wait for a “final” loss total to migrate calmly.

1+) may put funds at risk. 0Q (~72 bits entropy vs expected 128); TAPSIGNER / OPENDIME / SATSCARD not in scope. 48 BTC (~$38M) from ~500 single-sig wallets consolidated (Lookonchain cites bc1qnk4zh…).

Causal link “sweep = this RNG bug” is not proven by Coinkite: treat viral “stolen due to Coldcard” lines as Real-overstated. Dice rolls (≥50 fair) and strong BIP-39 passphrases change exposure; migrate calmly per vendor guidance.

369 take

Seed quality and single-sig habits matter as much as smart-contract risk.

Check device and firmware provenance, prefer strong passphrases or modern custody practices, and verify vendor advisories before you move size. Don’t treat on-chain aggregators as proof of root cause.

Pulse lesson: long-dormant single-sig bags are a soft target when generation entropy was weak.

Sources