Inside Wave 1: Tracing the Attacker’s Steps Through the 1,082 BTC Coldcard Drain | Praveen Perera<br>Inside Wave 1: Tracing the Attacker’s Steps Through the 1,082 BTC Coldcard Drain

Praveen Perera

August 12, 2026

Updated August 13, 2026

33 min read

bitcoin, security, coldcard, rng, entropy, forensics

Edit on GitHub

Affected users: Updating firmware does not repair a seed that affected firmware already generated. Read the official COLDCARD advisory and replace the affected seed before you use the wallet again. This post explains the incident. It is not a wallet-recovery guide.

Summary and key findings

Between 9:10 and 9:51 PM EDT on July 29 (01:10–01:51 UTC on July 30), an attacker swept 1,082.65318922 BTC from 1,195 traceable Bitcoin addresses . Galaxy Research reported the theft on July 31. I use Wave 1 for this first sweep group.

The affected seed path did not reach the hardware RNG. A build guard accepted a disabled hardware RNG, so normal seed generation used MicroPython’s non-cryptographic Yasmarang fallback. On a cold-start Mk3, that path had a small, structured state space that could be enumerated.

I reconstructed 328 wallet seeds behind 1,042 of the 1,195 source addresses. Those addresses contained 949.70395260 BTC , or 87.72% of Wave 1’s value. Several stolen addresses derive from the same seeds, which confirms seed-level compromise rather than unrelated private-key leaks.

The blockchain shows one operation split into value-sorted jobs. The 1,195 sweeps form three source branches and four broadcast queues. All use the same transaction template. The recovered seeds also divide into distinct scan-session ranges by destination branch.

The sweep system treated addresses as separate records, not wallets as the unit of work. Its 500-address cap, newest-first input order, and failure to process more than 200 UTXO records are consistent with an address API feeding a separate transaction builder. BlockCypher is the closest technical match I found, but the provider attribution remains an inference.

The final 153 source addresses, containing 132.94923662 BTC, remain unexplained. No researcher I have spoken with has reproduced a seed for any of them. They use the same transaction builder as the recovered set, so the missing input appears to be earlier in the attacker’s process. A private candidate or device dataset is the possibility I take most seriously.

The confirmed evidence establishes the weak firmware path, the reconstructed seeds, and the transaction structure. The attacker’s tools, data sources, and identity remain inferred or open. The final findings table separates these categories.

I’m Praveen Perera, the developer of Cove, an open-source Bitcoin wallet for iOS and Android funded by OpenSats. You can find me on X as @PraveenPerera. This article explains how I reconstructed Wave 1 from the firmware defect and the blockchain evidence.

Table of Contents

Summary and key findings

Terms used in this reconstruction

What this reconstruction assumes

The hardware RNG was never reached

Tracing the weak RNG path

What the recovered findings say about UID state

Other uses of the weak random stream

Galaxy’s Wave 1 baseline

Reconstructing the three branches

One transaction builder across the wave

First-seen times show how the sweep ran

From reconstructed seeds to stolen addresses

What the reconstructed RNG paths suggest

The attacker’s address pipeline

Why I suspect a paid API and an Ethereum-style workflow

The last 153 addresses

What is confirmed, inferred, and still open

How I got involved

Terms used in this reconstruction

Wave 1 is the first sweep group on July 29/30.

Source address is the Bitcoin address whose unspent outputs were taken in one sweep transaction.

Input is one previously unspent output consumed by that transaction. One source address can have many inputs.

Seed is the root secret from which a wallet derives keys and addresses.

Branch is one of the three source groups in this reconstruction.

Original 500 is the largest branch: 500 victim sweeps on Galaxy’s published collector path.

Holding 2 is 491 victim sweeps after one consolidation step.

Holding 3 is 204 victim sweeps after two consolidation steps.

Scan-session count is a position in the tested firmware flow before the seed request. It is not a literal count of button presses.

Pad is UID[0] XOR SysTick, the 32-bit Yasmarang state word on the weak path.

Observed pad range is the recovered pad high words from 15 through 75. The first search used 90 as an upper bound before that range was known.

Candidate stream is the sequence of weak seeds produced by enumerating reconstructed RNG states.

Historical snapshot is the fixed funded-address index from block 960182, immediately before Wave 1.

One wallet seed can derive several source addresses. Each source address was swept in a separate transaction.

What this reconstruction assumes

I began the Wave 1 reconstruction described here on August 6, one week...