Coldcard seed advisory widened; ~594 BTC single-sig sweep still

highBitcoincustodyUpdated2026-08-15 14:50 UTC · posted 2026-07-30

Coldcard seed advisory widened; ~594 BTC single-sig sweep still unproven link

30–31 Jul 2026: Coinkite warned that device-generated seeds on Coldcard Mk3 (firmware 4.0.1+) may put funds at risk. Updated advisory also flags seeds generated on Mk4 / Mk5 before 5.6.0 and Q before 1.5.0Q (~72 bits entropy vs expected 128); TAPSIGNER / OPENDIME / SATSCARD not in scope. Around the same window, ~594.48 BTC (~$38M) from ~500 single-sig wallets consolidated (Lookonchain cites bc1qnk4zh…). Causal link “sweep = this RNG bug” is not proven by Coinkite — treat viral “stolen due to Coldcard” lines as Real-overstated. Dice rolls (≥50 fair) and strong BIP-39 passphrases change exposure; migrate calmly per vendor guidance.

Update (2026-08-02) — Second sweep wave — Galaxy tracking ~1,158 BTC: 1–2 Aug 2026: Galaxy Research mapped a second wave attributed to the same operator class. Combined tracking ~1,158 BTC (~$70–75M class) from ~2,673 addresses across multiple attacker wallets (CoinDesk earlier expansion ~1,083 BTC / 1,196 wallets; some desks still climbing toward ~1,367 BTC). Firmware patch does not fix an already-weak seed — new seed + migrate. Causal “every sat = this RNG bug” remains research-attribution (Block/Galaxy), not a Coinkite courtroom proof — treat viral max $ as Real-overstated until settled. Enumeration is still running; don’t wait for a “final” loss total to migrate calmly.

Update (2026-08-02) — Third wave — +~208 BTC; Galaxy total ~1,367 BTC / 4,585 addresses: 1 Aug 2026 (Bitcoin Magazine pickup of Galaxy Research): a third sweep wave reported with another ~207.73 BTC moved. Combined tracking now ~1,367.05 BTC from ~4,585 addresses. Still the same enumeration campaign class — figures keep climbing as more bags are found. Review Coinkite’s official seed guidance; firmware alone does not repair an already-weak seed. Treat press “hack” shorthand and max-$ headlines with a Verify bar until causation vs total is settled.

Update (2026-08-03) — Fourth wave — ~449 BTC class; cumulative still climbing: 3 Aug 2026: Galaxy’s Alex Thorn flagged a likely fourth organized sweep while some spends were still in the mempool (~388–449 BTC range; later tally ~448.7 BTC from ~709 suspected addresses). RBF tip for unconfirmed spends only — once confirmed, migrate. Arithmetic add-on to prior three-wave ~1,367 BTC pushes observed totals toward ~1.8k BTC class — that sum is research tracking, not a Coinkite-confirmed final. Firmware update still does not fix an already-weak seed; generate new seed on fixed firmware and move calmly.

Update (2026-08-08) — Galaxy ~1,719 BTC (~$111 M) confirmed class; multi-attacker + early laundering: 7–9 Aug 2026 window: Galaxy Research high-confidence tracking cites ~1,719 BTC (~$111 M); wider desk estimates still range toward ~$130 M as enumeration continues. At least ~15 distinct attackers reported. Limited laundering observed (Wasabi-class BTC + Tornado Cash ETH). Coinkite migration guidance unchanged: fixed firmware exists, but updating alone does not repair an already-weak seed — generate a new seed on fixed firmware and migrate calmly. Treat viral max-$ totals as Real-overstated until settled; prefer Galaxy’s confirmed kernel for board language.

Update (2026-08-15) — Galaxy: ~1,779 BTC confirmed; sweeps look quiet after 6 Aug: 14 Aug 2026: Galaxy Research now puts high-confidence theft at 1,778.84 BTC (~$112.7 M) after speaking with 190+ victims, across more than 8,600 addresses. Confirmed attacker waves and footprints show no activity after 6 Aug — Galaxy reads that as most easy bags already moved or drained, not as “the bug is gone.” About 1,531 BTC still sits in attacker addresses; ~246 BTC has been moved (majority via CoinJoin). Firmware update still does not repair an already-weak seed — generate a new seed on fixed firmware and migrate calmly if you still hold on single-sig Coldcard addresses. A higher ~2,417 BTC / ~$153 M figure includes unconfirmed Wave 4 and other medium-confidence footprints — treat that as Real-overstated until Galaxy promotes it to the confirmed tally.

369 take: Seed quality and single-sig habits matter as much as smart-contract risk. Check device and firmware provenance, prefer strong passphrases or modern custody practices, and verify vendor advisories before you move size. Don’t treat on-chain aggregators as proof of root cause. Pulse lesson: long-dormant single-sig bags are a soft target when generation entropy was weak.