Home›Crypto›Market Structure›Coldcard hacker sweep links to blockchain data provide…

Coldcard hacker sweep links to blockchain data provider internal logs

The first July 2026 wave drained 1,082.65 BTC and more than 2,000 BTC is estimated across later waves, with confirmed losses above 1,800 BTC and roughly $118 million stolen so far.

Reported · Written up by our desk · Market Structure

Law enforcement may already know the person behind the July 2026 thefts from Coldcard hardware wallets, according to an investigation described by Bitcoin Magazine.

Block’s inquiry tied the attacker’s on-chain sweeps to a paid account at a major blockchain data provider, whose internal logs matched the theft pattern with “extraordinary specificity,” the outlet said. The coins from the first wave, 1,082.65 BTC, are still reported as unmoved in the attacker’s address, leaving open the possibility of a clawback.

The attack targeted weak private keys tied to seeds generated on Coldcard devices with vulnerable firmware, affecting hardware as old as the MK2 with firmware 4.0.1 and onwards. The reporting says the first and largest wave began on July 30, 2026, followed by subsequent waves.

Estimates cited in the coverage put total drained funds across multiple waves at more than 2,000 BTC, with confirmed and estimated losses exceeding 1,800 BTC from more than 5,000 addresses as of early August, while final totals remain under refinement. Bitcoin Magazine also referenced Alex Thorn at Galaxy Research tracking activity using on-chain pattern analysis and voluntary victim reports, and said about $118 million has been confirmed stolen.

Latest closeBitcoin $64,683.90 ▲0.3%

More like this

Sources