Coldcard Bitcoin Theft: FBI May Have Lead on Attacker
Alt text:
Investigators may have found a real world lead in the theft of more than 1,000 Bitcoin from Coldcard hardware wallets, but there is still no public confirmation that the FBI has identified or arrested the person behind the attack.
Bitcoin Magazine reported on Aug. 18 that information uncovered during an investigation by Block had been shared with law enforcement. Galaxy Research analyst Alex Thorn said the identity of the first wave attacker “may be known to law enforcement.”
The first wave drained 1,082.65 BTC on July 30. Those coins remain in addresses linked to the attacker, according to researchers tracking the incident. Across multiple waves, losses have exceeded 1,800 BTC, with estimates continuing to change as researchers identify additional affected wallets.
Key Takeaways
- Investigators linked the first Coldcard theft wave to a paid account at a blockchain data provider.
- The first wave stole 1,082.65 BTC, while later attacks appear to have targeted the same weak seed generation flaw.
- The FBI has not publicly confirmed a suspect, arrest, charges or recovery of the stolen Bitcoin.
- Coinkite says users with affected seeds must create new wallets and move their funds rather than relying on a firmware update alone.
A Blockchain Data Account May Have Given Investigators a Lead
The most significant development came from Block engineering lead Clay Garrett, whose team examined the attacker’s on chain activity. Investigators noticed that the attacker appeared to use a paid account with a blockchain services provider to search source addresses and conduct related activity during the wallet sweeps.
Block then contacted the provider and compared the suspected activity with its internal records. Garrett said the logs matched the number, timing and sequence of requests with “extraordinary specificity.”
“The operator used a paid account at a well-known blockchain-services provider to query the source addresses and perform other related activity.”
Block said it passed relevant information to authorities. It also said there was no evidence that the provider knowingly participated in or facilitated the theft. The discovery is significant because blockchain transactions normally provide investigators with wallet addresses rather than names. A paid service account could potentially provide additional records that help connect an on chain operator to a real world identity. However, neither the provider nor the account holder has been publicly identified.
FBI Identification Remains Unconfirmed
Thorn’s comment that the attacker’s identity “may be known to law enforcement” should not be interpreted as confirmation of an FBI breakthrough. There has been no public announcement confirming that investigators have identified a suspect, made an arrest, filed criminal charges or seized the stolen Bitcoin.
The first wave funds also remain at addresses associated with the attacker. That gives investigators a visible trail to monitor, but it does not mean the funds have been recovered. Later attacks could also complicate the investigation. Galaxy Research has reported evidence of multiple actors exploiting the Coldcard vulnerability, with some later waves showing different transaction patterns from the initial attack.
The Theft Came From a Years Old Seed Generation Flaw
The attacks were made possible by a vulnerability in Coldcard’s seed generation process. A firmware change introduced in 2021 caused affected devices to use a weak randomness path when generating certain wallet seeds. That reduced the number of possible private keys enough for attackers to search the vulnerable seed space and identify wallets holding Bitcoin.
Coinkite’s security record now lists affected firmware across several Coldcard product lines and confirms that the weakness was fixed in later releases. The company has stressed that simply updating the firmware does not make an existing vulnerable seed safe. Users whose seeds were generated under affected conditions need to create a new seed using corrected firmware and transfer their funds. Coinkite’s advisory specifically warns users who generated seeds on affected firmware without sufficient independent dice rolls to treat those seeds as at risk.
More Bitcoin Could Be at Risk
The investigation is not limited to the 1,082.65 BTC taken during the first wave. Galaxy Research reported that attackers began draining vulnerable Coldcard wallets in several waves after July 30, with losses reaching roughly $130 million by early August. Researchers believe multiple attackers may have independently exploited the same weakness. That means identifying the first attacker would not necessarily resolve every theft connected to the vulnerability.
It also leaves users with older Coldcard seeds facing a more immediate concern. The flaw existed for years before it was discovered, meaning some vulnerable wallets could remain exposed even if they have not yet been targeted.
What Happens Next
The paid blockchain data account could become one of the most important pieces of evidence in the investigation if its records can be connected to the person controlling the stolen Bitcoin.
For now, however, the case remains an investigation rather than a confirmed FBI identification. The movement of the 1,082.65 BTC, any law enforcement announcement and further disclosures from Block or Galaxy will be key developments to watch. For affected Coldcard users, the message remains more straightforward: update the device, generate a new seed and move funds from any potentially compromised wallet. Coinkite continues to advise affected users to migrate their assets rather than assume the firmware update protects an existing seed.
Conclusion
The Coldcard investigation has produced a potentially valuable lead by connecting the first theft wave to activity on a paid blockchain data account. That could help investigators bridge the gap between anonymous Bitcoin addresses and a real world operator.
But until the FBI or another authority confirms an identification, arrest or seizure, the attacker’s identity remains unverified. The investigation is still unfolding, while researchers continue tracking the stolen Bitcoin and the wider group of wallets exposed by the Coldcard seed generation flaw.
