coldcard.rip

Skip to contentAI-compiledNot affiliated with Coinkite / COLDCARDSnapshot 2026-08-03 22:59:15ZReport an error ↗

Likely attacker funds, inferred from victim reports and on-chain heuristics. Tentative, not confirmed — check the linked sources.

The plates<br>01The sweep

7,346 UTXOs · 2,896 sweeps · 1,432.48 BTC<br>02Flow chart

5,477 swept addresses · 613 destinations<br>03Routes

1,432.46 BTC still at tracked destinations<br>04Address ledger

bc1qxz7s2u…gqgf2451.07<br>bc1qhrgyed…w57uvw49.79<br>bc1qe85jr4…a2ahlr29.89

5,477 addresses · 7,346 UTXOs<br>05Evidence

25 public sources across 10 waves<br>06The bug

#ifndef HAS_RNG<br>#error "no hardware RNG"<br>#endif#define HAS_RNG 0 satisfies it

128 bits intended · 73.3 at best · 0 at worst<br>07How it shipped

4 commits · 2 direct pushes · 0 reviews<br>08Timeline

2018-05-22 · 1 code2020-07-30 · 1 code2021-01-28 · 1 code2021-03-01 · 1 code2021-03-17 · 1 code2021-05-01 · 1 loss reports2021-07-27 · 1 public posts2022-03-11 · 1 code2022-06-06 · 1 public posts2026-01-15 · 1 loss reports2026-07-30 · 6 on-chain2026-07-30 · 6 loss reports2026-07-30 · 2 advisories and fixes2026-07-30 · 16 public posts2026-07-31 · 3 on-chain2026-07-31 · 10 loss reports2026-07-31 · 11 advisories and fixes2026-07-31 · 18 public posts2026-08-01 · 12 loss reports2026-08-01 · 2 public posts2026-08-02 · 6 loss reports2026-08-02 · 4 advisories and fixes2026-08-02 · 7 public posts2026-08-03 · 1 on-chain2026-08-03 · 4 loss reports<br>five years, first commit to first sweep