Coldcard Over 1,000 Bitcoin Theft Incident Tracked: Identity of Initial Attacker Possibly Known to FBI

BlockBeats News, August 19, 2026: A new development has emerged in the Coldcard hardware wallet theft incident that occurred in July 2026. An investigation by Bitkey, a subsidiary of Block, revealed that the initial attacker had used a paid account of a well-known blockchain data service provider to query the affected addresses. The internal logs of the platform closely matched the attack in terms of request quantity, timing, and execution order, suggesting that the attacker's identity may have been identified by law enforcement.

Galaxy Research previously tracked that in the initial attack, a total of 1082.65 BTC was transferred, which is still held in the attacker's address. The cumulative loss from this Coldcard vulnerability incident has now exceeded 1800 BTC, involving over 5000 addresses.

The investigation revealed that the attack stemmed from a random number generation vulnerability in the Coldcard firmware, leading to insufficient entropy in the private keys generated by some devices, allowing the attacker to brute-force the wallets. Coldcard has since released a fix and advised affected users to migrate their funds as soon as possible.