{"id":31658,"date":"2026-08-18T17:13:07","date_gmt":"2026-08-18T16:13:07","guid":{"rendered":"https:\/\/investx.fr\/en\/2026\/08\/18\/coldcard-hack-wave-1-thief-fbi\/"},"modified":"2026-08-18T17:13:13","modified_gmt":"2026-08-18T16:13:13","slug":"coldcard-hack-wave-1-thief-fbi","status":"publish","type":"post","link":"https:\/\/investx.fr\/en\/crypto-news\/coldcard-hack-wave-1-thief-fbi\/","title":{"rendered":"Coldcard Hack: Wave 1 Thief May Already Be Known to the FBI"},"content":{"rendered":"\n

More than 1,082 BTC stolen<\/strong>, still sitting untouched in the hacker’s address. A concrete lead traced back to a paid account with a blockchain data provider. And one question hanging in the air: are we dealing with a sophisticated outside attacker, or an insider who knew about the bug for years?<\/p>\n\n\n\n

The Coldcard<\/strong> case is taking on a new dimension. According to investigators at Block<\/strong> and analysis from Alex Thorn<\/strong> at Galaxy Research<\/strong>, the identity of the hacker responsible for the first and most massive wave of drains may already be known to US law enforcement<\/strong>. A scenario that keeps alive the hope of eventual restitution for victims \u2014 provided the funds remain frozen.<\/p>\n\n\n\n

Here is what we know, and what the on-chain data reveals about one of the most significant Bitcoin<\/a><\/strong> hacks of 2026.<\/p>\n\n\n\n

1,082 BTC Stolen: A Digital Fingerprint That Betrays the Hacker<\/h2>\n\n\n\n

On July 30, 2026<\/strong>, an attacker began methodically draining Coldcard<\/strong> wallets that had generated their seeds under vulnerable firmware \u2014 an entropy bug<\/strong> that went undetected for five years, present as far back as the MK2 running firmware 4.0.1. The first wave, the most devastating, moved 1,082.65 BTC<\/strong> in a single coordinated sweep. Subsequent waves brought the estimated total to over 2,000 BTC<\/strong>, equivalent to approximately $118 million<\/strong> confirmed stolen at this stage.<\/p>\n\n\n\n

It was the engineering team at Block<\/strong>, through Clay Garrett<\/strong>, that produced the strongest lead. As early as July 31, Garrett published the findings of his investigation: “We identified an unusual pattern in the sweeps. That pattern led us to a hypothesis since confirmed: the operator used a paid account with a well-known blockchain data service provider to query the source addresses and carry out other related activity during the drains.”<\/em> Block<\/strong> contacted the provider, whose internal logs match the theft pattern with “extraordinary specificity.”<\/strong><\/p>\n\n\n\n

Alex Thorn<\/strong>, speaking during an appearance on Bitcoin Magazine’s YouTube channel<\/a><\/strong>, was explicit: “The identity of the Wave 1 attacker may be known to law enforcement.”<\/em> The 1,082.65 BTC from Wave 1 remain untouched<\/strong> in the hacker’s address \u2014 a crucial detail that keeps the door open to a potential clawback for victims.<\/p>\n\n\n\n

\"Coldcard<\/figure>\n\n\n\n

Entropy Bug or Insider Attack? The Question That Changes Everything<\/h2>\n\n\n\n

Behind the hunt for the hacker lies an even more unsettling question: who knew about this bug from the very beginning?<\/strong> The entropy vulnerability<\/strong> affecting private key generation on Coldcard MK2<\/strong> devices and later versions (firmware 4.0.1 and above) lay dormant for five years. Coinkite<\/strong> itself had publicly raised the risk of a “retirement attack”<\/strong> \u2014 a scenario in which an insider exploits a backdoor upon leaving the company.<\/p>\n\n\n\n

That hypothesis has not been ruled out. The surgical precision of the sweeps, the apparent foreknowledge of vulnerable addresses, and the use of a professional account with a blockchain data provider<\/a> all point toward someone with advanced technical expertise \u2014 and potentially privileged access to internal information. Wave 2, which adds approximately 76 additional BTC<\/strong> to the total, follows a sufficiently similar pattern for Alex Thorn<\/strong> to consider that the same actor may be behind it.<\/p>\n\n\n\n

The attack is still ongoing.<\/strong> Coinkite<\/a><\/strong> has issued an urgent advisory: any user of a Coldcard MK2<\/strong> or later model running firmware 4.0.1 or above must check their funds and move them immediately. More than 5,000 addresses<\/strong> have been compromised according to current estimates, and reports of new victims continue to come in. The window to act is still open \u2014 but it is closing fast.<\/p>\n\n\n\n

\n\n\n\n

Related articles :<\/h3>\n\n\n\n