New Research Details How Coldcard Attackers Prioritized Rich Wallets

New research by @PraveenPerera, as reported by Bitcoin News, offers a closer look at how attackers moved money out of Coldcard wallets. The study suggests the attackers first singled out vulnerable addresses, then sorted them by bitcoin holdings and began transferring funds from the addresses with the largest balances. The tool actually used for the transfers was fairly rudimentary. One example stands out. An address held 225 spendable UTXOs. The attacker withdrew exactly the newest 200, leaving the earliest 25 — including a UTXO worth 0.16 BTC — untouched. That pattern matches the default 200-record return limit of a blockchain API the researchers looked into. It appears the attacker may never have loaded the next page of data. The software also spent a 294-satoshi UTXO, reportedly inflating transaction fees by about 2,040 satoshis, a cost far greater than the UTXO's own value. The authors see this as evidence that the tool's builder may have a stronger grasp of account balance systems than of Bitcoin's UTXO model. Even though the attacker seems to have obtained the victim's full seed phrase, at least 75 BTC remain in other addresses derived from that same seed. The biggest puzzle: 132.95 BTC still sit in 153 stolen addresses. Researchers have been unable to reproduce the seeds behind those addresses, so they have not ruled out the possibility that the attacker gained access to undisclosed private device data or candidate data.