Galaxy Research Director: Coldcard attack investigation陷入 AI dilemma, forced to turn to Chinese open-source models to track stolen funds

Galaxy Research Research Director Alex Thorn stated that the attack targeting Coldcard wallet address generation is still ongoing. They are currently continuing to collect victim information and adding new victim addresses and attacker addresses to the investigation database.

If users are still using affected Coldcard single-signature addresses, they should immediately migrate their funds. According to current investigation results, all single-signature Coldcard addresses generated after the firmware upgrade in March 2021 may ultimately be emptied by attackers; it is just a matter of time.

According to Galaxy Research's analysis, the first three confirmed rounds of attacks exhibit highly programmatic characteristics, with similar attack transaction patterns. A large amount of stolen Bitcoin remains in the attackers' addresses and has not yet been transferred.

At the same time, some new opportunistic attackers are emerging, transferring and laundering funds through methods such as stripping the funding chain, cross-chain services (like ThorChain), and overseas betting platforms.

Additionally, Alex Thorn mentioned the limitations of AI tools in security investigations. Some large language models in the United States have restricted researchers' ability to track stolen funds, and the team has even had to turn to Chinese open-source AI models to assist in protecting user assets and conducting on-chain tracking.

He finds this phenomenon "incredible" and plans to promote discussions on related issues at the government and industry levels. Alex Thorn concluded by stating that a large amount of stolen funds remains stagnant, and the team is continuously tracking relevant addresses, having shared information with relevant U.S. agencies and industry partners. He calls on the Bitcoin community to learn from this incident, strengthen self-custody security education, and raise awareness of wallet complexity.