{"id":207133,"date":"2026-07-31T21:01:14","date_gmt":"2026-07-31T21:01:14","guid":{"rendered":"https:\/\/mycryptomania.com\/?p=207133"},"modified":"2026-07-31T21:01:14","modified_gmt":"2026-07-31T21:01:14","slug":"coldcard-bitcoin-thief-likely-used-top-blockchain-services-provider-report","status":"publish","type":"post","link":"https:\/\/mycryptomania.com\/?p=207133","title":{"rendered":"Coldcard Bitcoin Thief Likely Used Top Blockchain Services Provider: Report"},"content":{"rendered":"

Bitcoin Magazine<\/a><\/p>\n

Coldcard Bitcoin Thief Likely Used Top Blockchain Services Provider: Report<\/a><\/p>\n

<\/div>\n

Since over $70 million in Bitcoin was stolen yesterday by an attack<\/a> that exploited a fault in the Coldcard\u2019s system, it has been reported that the thief used a top blockchain services provider for help.\u00a0<\/p>\n

Writing on X Friday, engineer at payments company Block, Clay Garrett, said<\/a> that the provider \u2014 who he did not name at the request of the services provider \u2014 had been contacted after finding blockchain movements matched the \u201csuspected workflow\u201d of the attacker.\u00a0<\/p>\n

\u201cDuring our investigation of the Coldcard drain yesterday, we identified an unusual pattern in the sweeps,\u201d Garrett said.\u00a0<\/p>\n

\u201cThat pattern led us to a hypothesis that has since been confirmed: the operator used a paid account at a well-known blockchain-services provider to query the source addresses and perform other related activity during the sweeps,\u201d Garrett continued, adding that the authorities had been notified.\u00a0<\/p>\n

Galaxy Digital\u2019s research arm also wrote on X that the thief had an unusual pattern of moving the coins.\u00a0<\/p>\n

\u201cThe pattern tells us these were all the same attacker \u2014 it does not capture the attack itself, which looks the same as if a coin owner chose to move coins,\u201d the company said<\/a>, adding that Bitcoiners should move funds out of single-signature Coldcard addresses and into secure custody.<\/p>\n

After over $35 million in Bitcoin was drained from wallets on Thursday, Coinkite said that a firmware bug in Coldcard Mk3 devices \u2014 starting with version 4.0.1 in March 2021 \u2014 caused seed generation to fall back to a weak software Pseudorandom Number Generator instead of the hardware true random number generator.\u00a0<\/p>\n

This allowed private keys for many single-signature wallets (especially those created without dice rolls or a strong BIP-39 passphrase) predictable enough for attackers to brute-force.<\/p>\n

Later on Friday, Coinkite admitted all of its models were vulnerable following more thefts. Over $70 million has so far been swiped and engineers have warned that more Bitcoin addresses could be at risk<\/a>.\u00a0<\/p>\n

The company makes a number of Bitcoin products, including cold storage hardware wallets.<\/p>\n

This post Coldcard Bitcoin Thief Likely Used Top Blockchain Services Provider: Report<\/a> first appeared on Bitcoin Magazine<\/a> and is written by Mathew Di Salvo<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"

Bitcoin Magazine Coldcard Bitcoin Thief Likely Used Top Blockchain Services Provider: Report Since over $70 million in Bitcoin was stolen yesterday by an attack that exploited a fault in the Coldcard\u2019s system, it has been reported that the thief used a top blockchain services provider for help.\u00a0 Writing on X Friday, engineer at payments company […]<\/p>\n","protected":false},"author":0,"featured_media":207134,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-207133","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-discovery"],"_links":{"self":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/207133"}],"collection":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=207133"}],"version-history":[{"count":0,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/207133\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/media\/207134"}],"wp:attachment":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=207133"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=207133"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=207133"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}