Tag: cryptocurrency theft

Coldcard Bitcoin Hack Update: 64 BTC Moves Through Wasabi Mixer While 1,159 BTC Stays Dormant
Investigators tracking the Coldcard wallet vulnerability have detected fresh movement of stolen Bitcoin through a privacy mixer. While a separate attacker has begun obscuring roughly 64 BTC via Wasabi Wallet, the largest known theft cluster remains untouched.

1,159 BTC Still Unmoved

Galaxy Research linked the biggest theft to approximately 1,159 BTC held across seven attacker-controlled addresses. The attacker consolidated the funds within about 41 minutes of the exploit and has not sent them to exchanges, mixers, or other identifiable services since then.

Bitcoin’s protocol cannot freeze flagged addresses, so the funds remain spendable. However, converting such a large balance could expose the attacker. Exchanges, law enforcement agencies, and blockchain analytics firms are reportedly tracking around 600 addresses connected to the broader exploit.

Separate Attacker Moves 64 BTC Through CoinJoin

Analysts identified another attacker attempting to obscure approximately 64 BTC using Wasabi Wallet’s CoinJoin feature. About 10 BTC entered an initial mixing transaction, while roughly 54 BTC returned as change. The remaining Bitcoin later moved into outputs of about 7 BTC each, apparently for further mixing.

CoinJoin combines multiple inputs and outputs, making direct links harder to establish. Still, timing patterns, output sizes, later consolidations, and exchange deposits can reveal useful clues for investigators.

Exploit Scale and Affected Seed Phrases

Galaxy Research estimates confirmed losses near 1,596 BTC. A suspected additional attack wave could raise the total to about 2,055 BTC, while other researchers have placed losses above 1,800 BTC.

The vulnerability affected seed phrases created with weakened random-number generation. Firmware updates prevent new vulnerable seeds, but they cannot repair seed phrases already exposed. Affected users must create a new wallet seed and move their Bitcoin. Coldcard also destroyed remaining vulnerable inventory and urged users to generate fresh seeds.

South Korean Users Avoided Major Losses

South Korea’s Bitcoin community reported virtually no direct losses despite many experienced holders using Coldcard devices. Analyst Koji Higashi linked that outcome to local self-custody practices: community leaders had promoted independent entropy generation instead of relying solely on one hardware wallet manufacturer.

Local guides described 128 coin flips for 12-word seeds and 256 coin flips for 24-word seeds. Some users converted binary results using hardware calculators rather than phones, adding another layer of protection against compromised random-number generators.

Key Takeaways
- The 1,159 BTC connected to the largest Coldcard attacker remains unmoved since consolidation.
- A separate attacker has routed about 64 BTC through Wasabi Wallet CoinJoin transactions.
- Confirmed losses stand at roughly 1,596 BTC, with possible totals exceeding 2,000 BTC.
- Firmware updates cannot secure already exposed seed phrases; affected users must migrate to new wallets.
- Independent entropy generation helped many Korean users avoid direct losses.
September 10, 2026
Coldcard Firmware Bug Led to $70M Bitcoin Heist, Researchers Say
Galaxy Research has linked a firmware flaw in Coldcard hardware wallets to the theft of 1,082.65 Bitcoin, worth approximately $70 million. The coordinated withdrawals, which occurred across 1,196 addresses on July 30, took place within just 41 minutes, marking one of the largest reported hardware wallet incidents this year.

Galaxy Tracks a Coordinated Bitcoin Theft

Galaxy Research identified a consistent transaction pattern across the stolen funds, pointing to a single attacker behind the operation. However, the firm cautioned that the observed transfers may not include all exposed wallets. Other vulnerable addresses could remain inactive or be moved later. Blockchain records cannot distinguish between theft and a legitimate owner transfer when both use valid private keys, leaving the true extent of the breach uncertain.

Coinkite Expands Warning Across Coldcard Models

Coinkite initially warned owners of Coldcard Mk3 devices running firmware version 4.0.1, released in March 2021, that seeds created with the affected software could expose user funds. The company later widened the advisory to include selected firmware versions on Coldcard Mk4, Mk5, and Coldcard Q devices. Emergency updates were issued for every impacted model. Coinkite CEO Rodolfo Novak (NVK) accepted responsibility and apologized to customers, stating that the company’s internal review process failed to catch the defect before release.

AI-Assisted Analysis Raises New Security Concerns

Novak suggested that attackers may have discovered the flaw through artificial intelligence-assisted code analysis. Such tools can detect subtle weaknesses faster than traditional manual reviews, creating a growing challenge for software developers. While AI can help defenders inspect code, it also shortens the path from public release to exploitation.

What Affected Users Should Do

Coinkite urged affected users to take the following steps:
- Install the latest firmware version.
- Create new wallet seeds.
- Move Bitcoin into new wallets after testing small transfers first.
- Keep original backups until every transfer succeeds.
Coldcard wallets store private keys offline, but firmware bugs, supply chain risks, and configuration errors can still create attack paths. Galaxy Research linked the July 30 theft to vulnerable Coldcard wallet seeds across affected firmware versions. Coinkite released emergency updates and told users to create fresh seeds, test new wallets, and transfer funds while keeping original backups until every move succeeds.
September 9, 2026
Ex-FBI Agent Charged in Alleged $1M Cryptocurrency Theft From Investigative Wallets

A former FBI supervisory special agent has been arrested and charged with stealing nearly $1 million in cryptocurrency using access obtained through a national security investigation. The case has sent shockwaves through the law enforcement and crypto communities, raising serious questions about insider abuse of sensitive investigative tools.

Who Is Patrick Yaroch?

Patrick Steven Yaroch previously served as a supervisory special agent in the FBI’s Counterintelligence and Espionage Division and also worked in the bureau’s Boston office. His role granted him access to sensitive information about cryptocurrency accounts that were being monitored as part of national security investigations.

According to court records, Yaroch told a Justice Department employee that he was frustrated the FBI “could not or would not act against adversarial cryptocurrency accounts.” He reportedly said he was upset that he couldn’t do more to disrupt cryptocurrency use by an adversarial nation during an investigation.

In an FBI affidavit, Yaroch admitted to making “some very poor decisions” and said he “went into FBI systems and found keys needed to transfer money from wallets to himself.”

How Was the Crypto Allegedly Stolen?

Court documents allege that Yaroch set up a personal cryptocurrency wallet in late 2024 and obtained passphrases and other wallet-access information through FBI databases. He allegedly completed between 10 and 12 transfers beginning in late 2024 or early 2025, moving digital assets into wallets under his control.

Federal agents later searched Yaroch’s home in Ashburn, Virginia, where they recovered devices, a hardware wallet, and handwritten notes believed to contain cryptocurrency seed phrases. Authorities eventually transferred approximately $925,000 in cryptocurrency from accounts under his control into government-controlled wallets.

Plans to Manage the Funds

Investigators also found conversations on Yaroch’s phone in which he explored ways to invest or manage around $1 million and considered relocating overseas. Recovered records reportedly included material connected to Portugal and plans for international travel.

An FBI spokesperson said: “The individual has since been fired from the Bureau. We hold our employees to the highest ethical standards, and this conduct is not tolerated at the FBI. We are conducting a thorough investigation in the aftermath, and as this is an ongoing matter, we will have no further comment.”

Federal Charges and Next Steps

Authorities said Yaroch eventually disclosed his actions to a former colleague and contacted government officials about his conduct. He now faces federal charges related to interstate transportation of stolen property and receipt of stolen property. The allegations remain unproven, and the criminal case is ongoing.

August 5, 2026
Coldcard Wallet Hack Exceeds $100 Million: 1,596 BTC Stolen Across 7,300 Addresses

Galaxy Research has revised its estimate of the Coldcard wallet hack, now linking 1,596 Bitcoin (BTC) — worth over $100 million — to the exploit. The attack targeted approximately 7,300 addresses across three major waves and 14 smaller incidents. A suspected fourth wave could push total losses to 2,055 BTC, or roughly $130 million.

Galaxy Raises Confirmed Theft Estimate

Researchers at Galaxy received reports from 73 victims, which helped verify the three primary attack waves. The reports also revealed smaller transaction patterns that may involve other attackers exploiting the same vulnerability. The updated figure far exceeds the initial estimate of $70 million, as investigators continued to identify new addresses, victims, and transaction groups while the attacks unfolded.

The first major wave began on July 30, draining approximately 1,082.65 BTC from 1,196 addresses in just 41 minutes. At the time, that Bitcoin was valued at about $70.2 million. Two subsequent waves followed. By August 2, researchers had traced roughly 1,367 BTC across 4,585 addresses. The third wave took about 208 BTC from 1,912 smaller accounts.

Galaxy noted that each wave followed a consistent pattern, suggesting a single operator, but researchers could not definitively link every wave to the same attacker. It remains possible that additional attackers joined after the vulnerability was disclosed.

Weak Seeds Exposed Private Keys

The attackers did not compromise the Bitcoin network itself. Instead, they targeted recovery seeds generated by certain Coldcard firmware versions that used weak random data. A hardware wallet should generate a recovery seed from secure, unpredictable information — a process that creates entropy and protects private keys from offline guessing.

Coldcard introduced the flaw during a firmware update in March 2021. Seed generation shifted from the device’s hardware random-number generator to software within the libNgU and MicroPython stack. An integration error then routed the process to MicroPython’s deterministic fallback, which relied heavily on device details and timing values. This drastically reduced the number of possible seeds, allowing attackers to generate candidate seeds offline, derive related Bitcoin addresses, and compare them with addresses on the blockchain — all without physical access to a victim’s device.

Coinkite Lists Affected Firmware Versions

Coinkite estimates that affected Mk2 and Mk3 wallets produced only about 40 bits of effective entropy. Mk4, Mk5, and Q models reached approximately 72 bits, still below the intended 128 bits. The advisory covers Mk2 and Mk3 firmware versions 4.0.1 through 4.1.9, Mk4 and Mk5 standard firmware before 5.6.0 and Edge firmware before 6.6.0X, and Coldcard Q standard firmware before 1.5.0Q and Edge firmware before 6.6.0QX. TAPSIGNER, OPENDIME, and SATSCARD use separate codebases and are not affected.

The alert coincided with heavy movement from small Bitcoin addresses. Transfers below 1 BTC reached 39,600 BTC in one day, according to CryptoQuant research head Julio Moreno — the highest daily movement in that category since November 2022, when users moved about 39,900 BTC shortly after FTX collapsed. While not every transfer came from a Coldcard user, the timing suggests that some holders shifted funds to new wallets or exchanges after the security warning.

Conclusion

Galaxy Research has confirmed 1,596 BTC in losses across three attack waves and 14 smaller incidents. The flaw weakened recovery-seed randomness in several Coldcard firmware versions. Users with affected devices should follow Coinkite’s advisory and move funds to wallets created with secure, updated software.

August 4, 2026
Coldcard Firmware Bug Leads to $70M Bitcoin Theft From 1,196 Wallets

An attacker drained 1,082.65 Bitcoin, worth approximately $70 million, from 1,196 wallets during a 41-minute sweep on July 30. Galaxy Research mapped the full event after early reports captured only part of the theft.

Galaxy Maps a Batched Bitcoin Sweep

Galaxy found that the attacker moved the bitcoin between 01:10 and 01:51 UTC across six blocks. Three blocks between those transfers contained no related transactions. That pattern indicates the operator broadcasts transactions in batches rather than sending them continuously. The stolen bitcoin now sits in four addresses and has not moved.

Early coverage tracked only one destination address, which kept the first loss estimate much lower. Galaxy later connected the remaining addresses and nearly doubled the reported amount. The attacker drained 1,183 native SegWit wallets, seven older standard addresses, and six still older addresses. This mix points to systematic seed testing across several derivation paths.

Firmware Error Reduced the Seed Range

Coldcard devices should create seeds with a dedicated hardware random number generator. An internal build setting instead told affected firmware to skip that generator. A supporting library checked whether the setting existed but failed to check whether developers had enabled it. The software then used a fallback tied to the chip serial number and clock registers.

The serial number remains fixed, while an attacker can narrow or reproduce clock timing. As a result, the possible seeds fell from an immense range to a searchable set. Security teams reproduced key generation on older Mk2 and Mk3 devices. For the Mk4, Q, and Mk5, they estimated a range of about four billion possible seeds. An attacker can generate candidate seeds, derive their addresses, and compare them with the public blockchain. The victim’s hardware never needs to connect during that search.

Device Scope Dispute Leaves Owners Exposed

Galaxy warned that more sweeps could follow unless affected owners move their funds. Owners cannot run a test that shows whether their seed falls inside the reproducible range. Coinkite, Coldcard’s maker, warned Mk3 owners and said newer models remain unaffected. Block’s report also placed the Mk2, Mk4, Q, and Mk5 within the affected scope.

The disagreement leaves users without a verified way to separate safe devices from exposed ones. Anyone who generated a seed with affected firmware must treat that seed as vulnerable. Block’s Clay Garrett said the operator used a paid account at a well-known blockchain data provider. Internal logs reportedly matched the suspected queries by number, timing, and sequence. The provider supplied standard services and saw no clear sign of the attacker’s purpose. Block passed the account information and related evidence to authorities.

Conclusion

Galaxy Research traced the theft to 1,196 wallets and four holding addresses. The seed-generation flaw reduced key security to a searchable range, while reports disagree on affected models. Galaxy warned that further sweeps could follow, making fund movement the only action described for potentially exposed owners.

August 2, 2026
Hinkal Protocol Drained of $830K in Proofless Deposit Exploit; Stolen Funds Laundered Through Tornado Cash and Thorchain

On July 3, attackers exploited Hinkal, a privacy-focused DeFi protocol, draining approximately $830,000 in USDC — nearly the entire total value locked (TVL) across the five blockchains it supports. Blockchain security firm CertiK traced the breach to an externally owned account that repeatedly executed ‘Transact’ calls after completing a ‘proofless deposit.’ According to DeFiLlama, Hinkal’s TVL stood at roughly $829,000 just before the attack.

How the Exploit Worked

CertiK identified the attacker’s wallet as 0xbB3f01a1b1C68F3DEB36C55342b5F5706c32fc20 and reported that it siphoned over $800,000 from a Hinkal smart contract. Meanwhile, PeckShield, citing on-chain investigator Specter, placed the total loss near $820,000 — slightly lower than CertiK’s estimate. The exploit leveraged a vulnerability in Hinkal’s deposit mechanism, allowing the hacker to withdraw funds without providing the required proof.

Laundering the Stolen Crypto

After the theft, the attacker converted the stolen USDC into Ether and quickly moved the funds through privacy tools and cross-chain bridges. CertiK noted that the wallet deposited 410 ETH (worth about $700,000) into Tornado Cash, an Ethereum mixer currently under U.S. sanctions. Separately, PeckShield reported that the attacker sent 44.67 ETH through Thorchain, converting it into Bitcoin, which eventually reached an address beginning with bc1qr2sf. This laundering pattern — combining sanctioned mixers with decentralized bridges — is commonly observed in DeFi exploits.

A research article presented at the ACM Web Conference 2026 found that sanctioned cryptocurrency mixers still provide effective anonymity despite increased regulatory pressure. CertiK has also noted that both criminals and legitimate privacy-conscious users continue to use Tornado Cash, complicating efforts to distinguish illicit transactions from lawful ones.

Impact on Hinkal’s Institutional Privacy Model

Hinkal markets itself as an institutional-grade privacy layer, enabling users to create shielded addresses and perform swaps, transfers, and payments without exposing balances or counterparties. The protocol operates on Ethereum, Arbitrum, Base, Polygon, and OP Mainnet. It raised $5.5 million in seed and strategic funding from investors including Draper Associates, Quantstamp, and NGC Ventures. Just one day before the exploit, Hinkal announced a partnership with wallet infrastructure provider Turnkey to bring privacy features to Turnkey users.

At the time of the attack, Hinkal ranked near the bottom of privacy protocols by TVL. DeFiLlama listed Tornado Cash at $440 million, Railgun at $77.5 million, and Privacy Pools at about $7.8 million — while Hinkal held just $829,000 before the exploit drained nearly all of it.

What’s Next

The Hinkal exploit removed roughly $830,000 in USDC, nearly matching the protocol’s total locked value. Users are advised to monitor official updates from Hinkal and carefully assess the risks associated with privacy-focused DeFi platforms.

July 4, 2026
Crypto Hack Losses Drop 7% in June, Humanity Protocol Hit by $36M Exploit

Crypto-related thefts declined in June after several months of heavy losses, although attackers continued targeting blockchain projects through private key compromises and bridge vulnerabilities. Blockchain security firm PeckShield reported about $75.9 million stolen across 40 major incidents, marking a 7.1% decrease from May’s $81.7 million.

Even so, the monthly decline did little to slow the year’s overall losses. Data from blockchain intelligence firm TRM Labs showed crypto hacks and exploits have already cost the industry more than $750 million in 2026, with two large attacks recorded earlier this year accounting for a major share of that total.

Humanity Protocol Records June’s Largest Exploit

Humanity Protocol recorded the biggest security breach during June. PeckShield estimated the exploit at about $31 million, while the project’s internal investigation later placed losses closer to $36 million. According to the project, attackers gained access after compromising a private key linked to the protocol’s bridge administration.

Founder Terence Kwok said the breach resulted from a compromised private key. Humanity Protocol also stated that attackers accessed bridge administration on Ethereum and BNB Chain after compromising a developer’s laptop. The project said the incident allowed hackers to drain wallets and mint about 447 million H tokens. Reports also stated that the exploit triggered an 80% to 90% decline in the token’s market price. Humanity Protocol added that it is preparing a recovery plan, including a possible 1:1 token airdrop for affected users. Meanwhile, reports linked the attack to North Korea’s Lazarus Group, although investigations remain ongoing.

Bridge Exploits and Protocol Attacks Continue

Beyond Humanity Protocol, several blockchain projects also suffered large losses during June. PeckShield reported that Syscoin Bridge lost about $10 million after attackers exploited a validation flaw that allowed billions of unsupported SYS tokens to be minted without the required token burn.

A bot associated with the address JaredFromSubway.eth also lost about $7.5 million after being targeted by another exploit. Other affected platforms included Secret Network, Polymarket users, SecondFi and TESSERA, with reported losses ranging between $2.4 million and $4.67 million.

Meanwhile, Aztec’s deprecated infrastructure was exploited twice during the month. PeckShield tracked approximately $2.16 million stolen from Aztec Bridge and another $2.1 million from Aztec Connect. According to the Aztec Foundation, both immutable contracts are no longer under its control and cannot be paused. Combined losses reached about $4 million.

The remaining projects in PeckShield’s top ten included Taiko Bridge, Token of Power, Raydium and LABUBU/OLPC, with each incident resulting in losses exceeding $1 million.

Crypto Losses Remain High in 2026

Although June recorded a lower monthly total, overall crypto losses during 2026 remain elevated. TRM Labs estimated that hackers have already stolen more than $750 million this year. According to the firm, two attacks linked to North Korea accounted for much of those losses.

On April 1, Drift Protocol lost about $285 million after attackers reportedly spent months using social engineering tactics against governance signers. Later, on April 18, Kelp DAO’s LayerZero bridge lost approximately $292 million after attackers compromised its verifier network.

Meanwhile, PeckShield reported that the Humanity Protocol exploiter has moved stolen assets across Bitcoin, Solana, Hyperliquid, and BNB Chain. The firm also found that some funds were mixed with assets connected to the separate Kelp DAO exploit. PeckShield said this pattern ‘raises the possibility the same threat actor is behind both attacks,’ though no final attribution has been confirmed.

July 2, 2026