Identity of Coldcard Attacker May Be Known to Authorities

U.S. cybercrime agencies are investigating the attack on Coldcard hardware wallets, where over 2000 BTC were drained. Alex Thorn, head of research at Galaxy Digital, indicated that the identity of the 'wave 1' attacker may be known to the authorities. This phase represents the largest volume of compromised funds, with 1082.65 BTC identified. Block engineers discovered that the attacker used a centralized provider of Bitcoin RPC node infrastructure and are collaborating with authorities. The vulnerability originated from an integration defect in the firmware of several versions of Coldcard, limiting cryptographic entropy in the recovery seed generation, allowing attackers to reproduce the private key generation process offline. Galaxy Digital is distributing operational data of the addresses linked to the breach to assist in the investigation. Thorn emphasized the importance of victims filing formal complaints to facilitate potential restitutions and to preserve their physical devices. It is recommended not to restart, format, or destroy the affected equipment, as well as to keep the packaging and receipts, as these may be crucial in establishing ownership of the funds.