New developments in the Coldcard theft incident, the identity of the first wave of attackers may have been grasped by the FBI

According to Bitcoin Magazine, the investigation into the large-scale theft of Coldcard hardware wallets in July 2026 has made progress. Approximately 1,082.65 BTC (about $118 million) from the first wave of attacks remains in the attackers' addresses. The investigation found that the attackers used a paid account from a certain blockchain data service provider, and the internal logs "highly match" the theft pattern. Relevant clues have been handed over to law enforcement. Galaxy Research analyst Alex Thorn stated that the identity of the first wave of attackers "may have been grasped by law enforcement."

Subsequent waves of attacks resulted in a total theft of about 2,000 BTC, with the second wave accounting for approximately 76 BTC. The operational pattern was similar to the first wave, possibly indicating the same perpetrator. The incident originated from an entropy generation vulnerability introduced in Coinkite's code update in March 2021, which caused some devices using MK2 and later models, with firmware version 4.1 and above, to generate low-strength private keys that could be brute-forced. Coinkite has released a fixed firmware and advised users to migrate their assets, but the scope of the vulnerability's impact is still being assessed.