Coldcard Attacker Begins Mixing Stolen Bitcoin as Volunteer Auditors File 85 Critical Bugs Across Bitcoin Code

There is new movement in the theft that drained bitcoin from users of COLDCARD hardware wallets. On-chain investigators told crypto.news that the largest known attacker address, which holds 1,159 bitcoin (BTC), remains untouched. A separate attacker has started sending smaller amounts through a mixing service. Galaxy Research is tracking the balances.

The root cause is not a smart-contract bug but a defect in how the device created keys. A firmware build from March 2021 routed wallet seed creation through a software random number generator (RNG) instead of the hardware one. That narrowed the range of possible seeds and made affected wallets reconstructible by anyone who found the flaw. Thefts began on 30 July from long-dormant addresses. Loss estimates diverge: BleepingComputer put the total near 1,367 BTC, about $88 million, while Bitcoin Magazine describes over $100 million drained and TechCrunch reported more than $130 million. No funds have been recovered or frozen, and no attacker has been identified. Manufacturer Coinkite shipped patched firmware and told users with seeds generated on affected versions to move their funds, a warning amplified on Bitcointalk.

The response has become an audit campaign. The Bitcoin Red Team, led by the developer known as Calle and by Rob Hamilton, says it has filed 4,962 findings across 390 open-source repositories, 85 of them rated critical. The group uses artificial-intelligence-assisted code review to search for the same class of entropy and implementation errors.

Analysts are treating the episode as a question about custody. Cantor expects regulated custody providers to benefit, and FRNT expects some holders to shift toward bitcoin exchange-traded funds (ETFs), according to CoinDesk. Bitcoin Magazine's own commentary argues the opposite conclusion, that a vendor defect is a reason to improve key practice rather than to hand keys to intermediaries.