Coldcard Bitcoin Theft: FBI May Have Lead on Attacker
Coldcard Bitcoin Theft: FBI May Have Lead on Attacker Alt text: Investigators may have found a real world lead in the theft of more than 1,000 Bitcoin from Coldcard hardware wallets, but there is still no public confirmation that the FBI has identified or arrested the person behind the attack. Bitcoin Magazine reported on Aug. 18 that information uncovered during an investigation by Block had been shared with law enforcement. Galaxy Research analyst Alex Thorn said the identity of the first wave attacker “may be known to law enforcement.” The first wave drained 1,082.65 BTC on July 30. Those coins remain in addresses linked to the attacker, according to researchers tracking the incident. Across multiple waves, losses have exceeded 1,800 BTC, with estimates continuing to change as researchers identify additional affected wallets. Key Takeaways A Blockchain Data Account May Have Given Investigators a Lead The most significant development came from Block engineering lead Clay Garrett, whose team examined the attacker’s on chain activity. Investigators noticed that the attacker appeared to use a paid account with a blockchain services provider to search source addresses and conduct related activity during the wallet sweeps. Block then contacted the provider and compared the suspected activity with its internal records. Garrett said the logs matched the number, timing and sequence of requests with “extraordinary specificity.” “The operator used a paid account at a well-known blockchain-services provider to query the source addresses and perform other related activity.” Block said it passed relevant information to authorities. It also said there was no evidence that the provider knowingly participated in or facilitated the theft. The discovery is significant because blockchain transactions normally provide investigators with wallet addresses rather than names. A paid service account could potentially provide additional records that help connect an on chain operator to a real world identity. However, neither the provider nor the account holder has been publicly identified. FBI Identification Remains Unconfirmed Thorn’s comment that the attacker’s identity “may be known to law enforcement” should not be interpreted as confirmation of an FBI breakthrough. There has been no public announcement confirming that investigators have identified a suspect, made an arrest, filed criminal charges or seized the stolen Bitcoin. The first wave funds also remain at addresses associated with the attacker. That gives investigators a visible trail to monitor, but it does not mean the funds have been recovered. Later attacks could also complicate the investigation. Galaxy Research has reported evidence of multiple actors exploiting the Coldcard vulnerability, with some later waves showing different transaction patterns from the initial attack. The Theft Came From a Years Old Seed Generation Flaw The attacks were made possible by a vulnerability in Coldcard’s seed generation process. A firmware change introduced in 2021 caused affected devices to use a weak randomness path when generating certain wallet seeds. That reduced the number of possible private keys enough for attackers to search the vulnerable seed space and identify wallets holding Bitcoin. Coinkite’s security record now lists affected firmware across several Coldcard product lines and confirms that the weakness was fixed in later releases. The company has stressed that simply updating the firmware does not make an existing vulnerable seed safe. Users whose seeds were generated under affected conditions need to create a new seed using corrected firmware and transfer their funds. Coinkite’s advisory specifically warns users who generated seeds on affected firmware without sufficient independent dice rolls to treat those seeds as at risk. More Bitcoin Could Be at Risk The investigation is not limited to the 1,082.65 BTC taken during the first wave. Galaxy Research reported that attackers began draining vulnerable Coldcard wallets in several waves after July 30, with losses reaching roughly $130 million by early August. Researchers believe multiple attackers may have independently exploited the same weakness. That means identifying the first attacker would not necessarily resolve every theft connected to the vulnerability. It also leaves users with older Coldcard seeds facing a more immediate concern. The flaw existed for years before it was discovered, meaning some vulnerable wallets could remain exposed even if they have not yet been targeted. What Happens Next The paid blockchain data account could become one of the most important pieces of evidence in the investigation if its records can be connected to the person controlling the stolen Bitcoin. For now, however, the case remains an investigation rather than a confirmed FBI identification. The movement of the 1,082.65 BTC, any law enforcement announcement and further disclosures from Block or Galaxy will be key developments to watch. For affected Coldcard users, the message remains more straightforward: update the device, generate a new seed and move funds from any potentially compromised wallet. Coinkite continues to advise affected users to migrate their assets rather than assume the firmware update protects an existing seed. Conclusion The Coldcard investigation has produced a potentially valuable lead by connecting the first theft wave to activity on a paid blockchain data account. That could help investigators bridge the gap between anonymous Bitcoin addresses and a real world operator. But until the FBI or another authority confirms an identification, arrest or seizure, the attacker’s identity remains unverified. The investigation is still unfolding, while researchers continue tracking the stolen Bitcoin and the wider group of wallets exposed by the Coldcard seed generation flaw.
bitcoin.com Adds UAE-Registered Stablecoin to Self-Custodial Wallet
Bitcoin.com has integrated USDU, a US dollar backed stablecoin registered with the Central Bank of the United Arab Emirates, into its self custodial wallet. The integration, announced on August 19, gives Bitcoin.com users on web and mobile access to USDU for holding, sending and receiving. Users will retain control of their private keys, while additional features such as swaps and buy and sell services are planned through third party providers. Key Takeaways USDU Expands Beyond Institutional Users USDU is issued by Abu Dhabi based Universal Digital Intl. Limited and operates as a Foreign Payment Token under the UAE Central Bank’s Payment Token Services Regulation. Universal said USDU became the first US dollar backed stablecoin registered by the UAE central bank under the framework when it received its registration in January 2026. The stablecoin is issued as an ERC 20 token on Ethereum and is backed 1:1 by US dollar reserves held at Emirates NBD and Mashreq. Universal also says the reserves undergo monthly independent attestations, with reports made available publicly. Bitcoin.com executive Corbin Fraser highlighted the importance of reserve transparency when discussing the integration. “People shouldn’t need to be forensic accountants to know what backs the stablecoin they hold.” Universal Digital is also regulated by the Financial Services Regulatory Authority in Abu Dhabi Global Market to issue fiat referenced tokens. However, USDU’s regulatory status does not mean it is approved for unrestricted payment use across every jurisdiction. bitcoin.com Plans Wider Usdu Functionality The initial Bitcoin.com Wallet integration is focused on basic stablecoin functionality. Users can hold USDU and transfer it directly from their self custodial wallets. Bitcoin.com plans to expand the offering with swap and buy and sell services through third party providers. The company has also said it intends to accept USDU for designated services and work toward enabling payments between users and merchants across its products. The rollout gives USDU access to a broader retail audience after earlier developments focused more heavily on institutional infrastructure. In July, Zodia Custody added support for USDU, allowing institutional clients to hold and transfer the stablecoin. A USDT USDU liquidity pool was also launched on Uniswap in August, providing another route for on chain liquidity. The Bitcoin.com integration therefore adds a consumer wallet distribution channel to USDU’s growing network of infrastructure and liquidity options. UAE Regulated Stablecoins Gain Wider Distribution The development comes as the UAE continues building a regulated framework for digital assets and payment tokens. For Bitcoin.com users, the main distinction is that USDU can be held without handing custody of the assets to Bitcoin.com. The wallet’s self custodial structure allows users to maintain control of their private keys while using a dollar denominated token for transfers. However, the integration does not mean every USDU feature will immediately be available to every user. Bitcoin.com said functionality and availability can vary depending on jurisdiction and the services provided by third party partners. The expansion also remains relatively early in USDU’s development compared with established dollar stablecoins. Its integration into Bitcoin.com gives the token a wider distribution channel, but the available information does not establish it as a major global stablecoin by market share or liquidity. Conclusion Bitcoin.com’s integration gives USDU a new route into the retail market through a self custodial wallet. The move combines regulated stablecoin infrastructure from the UAE with direct user control over digital assets. For Universal Digital, the partnership broadens distribution beyond institutional channels. For Bitcoin.com users, it adds a regulated dollar backed asset that can be held and transferred without giving up custody to the wallet provider.
South Korea Moves to Block Polymarket Over Gambling Concerns
South Korea has ordered access to Polymarket to be blocked after regulators determined that the crypto prediction market provides an illegal gambling environment for users in the country. The decision was made on Tuesday, August 18, following a review by the Korea Media and Communications Standards Commission. Authorities concluded that Polymarket’s event contracts could fall under provisions of South Korean law covering gambling and the operation of gambling venues. South Korean regulators focused on the financial consequences of those positions rather than how the platform is technically structured. Polymarket allows users to buy and sell positions based on the outcome of real world events, including elections, sports, economic decisions and weather. The value of a position changes as the market’s implied probability changes, with winning positions receiving payouts when an event is settled. Key Takeaways Regulators Reject Polymarket’s Noncustodial Argument Polymarket argued that its structure separates it from conventional gambling operators. During the regulatory process, the company said it had removed its Korean language service and did not accept payments in Korean won. The company also argued that transactions are noncustodial and conducted through smart contracts, meaning Polymarket does not directly take custody of users’ funds. South Korean authorities rejected that distinction. The commission said companies cannot avoid domestic law simply because of technical characteristics or the way their services are delivered. Regulators instead examined what users can actually do on the platform and how Polymarket operates its markets. They pointed to its role in creating markets, establishing trading rules, providing deposit and withdrawal mechanisms, settling positions and collecting transaction fees. The commission also highlighted markets linked specifically to South Korea, including one concerning rainfall in Seoul during August, as evidence that the platform could facilitate activity relevant to Korean users. Authorities consulted the National Police Agency, the National Gambling Control Commission and the Korea Sports Promotion Foundation before reaching their decision. The agencies reportedly concluded that Polymarket’s operations could fall within South Korean restrictions on gambling and similar betting activities. A Growing Regulatory Problem for Prediction Markets The South Korean action follows a regulatory review that began earlier this year. Authorities had been examining whether Polymarket’s prediction contracts constituted illegal gambling, while police also investigated local users over their participation in election related markets. South Korea is not alone in restricting the platform. France, Australia and Germany have also taken action against Polymarket, while other jurisdictions have raised concerns over its gambling implications. The issue is becoming more significant as prediction markets expand beyond traditional financial speculation. Platforms can now offer contracts covering elections, sports, weather, interest rates and other real world events. Supporters argue that prediction markets aggregate information and provide a market based view of expected outcomes. Regulators can take a different view when users put money at risk based on events whose outcomes they cannot control. That distinction is particularly important in countries with strict gambling laws. What the Block Means for Polymarket Blocking access may make it harder for Polymarket to serve South Korean users, but it does not necessarily remove the underlying technology from the internet. Because the platform uses blockchain infrastructure and noncustodial mechanisms, enforcement presents different challenges from shutting down a conventional centralized betting operator. For Polymarket, however, the growing number of restrictions creates a broader compliance problem. The platform must increasingly account for different national interpretations of prediction markets, gambling and financial products. The South Korean decision also sends a message to other decentralized applications: operating through smart contracts does not necessarily prevent regulators from applying local laws. Conclusion South Korea’s decision marks another significant regulatory challenge for Polymarket and the wider prediction market sector. The ruling shows that regulators may judge these platforms by the economic activity they facilitate rather than simply by whether they use blockchain or allow users to retain custody of their assets. As prediction markets continue expanding, the distinction between financial trading and gambling is likely to remain a major regulatory question. For decentralized platforms, South Korea’s approach is another indication that technical decentralization alone may not be enough to avoid restrictions imposed by national law.