Law enforcement may already know the identity of the operator behind the first and largest wave of the July 2026 Coldcard wallet drains, according to a report published by Bitcoin Magazine. The first wave alone moved 1,082.65 BTC, and those coins remain untouched in the attacker’s address, leaving open the possibility that victims could still recover that tranche.
The attack is still ongoing, the report said, and it targets weak private keys generated by affected Coldcard devices, including units as old as the MK2 running firmware 4.0.1 and later. Users who may have one of those devices were urged to verify their exposure and move funds as soon as possible.
Authorities may already have a lead on Wave 1
Bitcoin Magazine said the drains began on July 30, 2026, when an attacker started systematically emptying wallets that had generated seeds under vulnerable firmware. The flaw had gone undiscovered for years. The first and biggest wave transferred 1,082.65 BTC, and later waves pushed estimates above 2,000 BTC.
Alex Thorn of Galaxy Research has been tracking the activity through on-chain pattern analysis and voluntary victim reports. As of early August, confirmed and estimated losses across several waves had exceeded 1,800 BTC from more than 5,000 addresses, though the total was still being refined as new reports came in. In dollar terms, the report said roughly $118 million has been confirmed stolen.
Thorn has discussed the possibility that investigators already hold a concrete lead on the person behind the largest tranche. In a Bitcoin Policy Institute segment carried on the Bitcoin Magazine YouTube channel, he said, 「Wave one’s identity, attacker identity, may be known to law enforcement.」 He added that Wave 1 remains the largest single chunk identified so far, that the coins are still sitting in the attacker’s address, and that Wave 2 looks similar enough that it may involve the same actor. Wave 2 added another 76 or so BTC to the tally.
Block says sweep pattern led to a paid account at a blockchain provider
The main source behind the claim that the attacker’s identity may be known is Clay Garrett, engineering lead at Block working on Bitkey. On July 31, 2026, Garrett published findings from Block’s investigation.
He wrote: 「During our investigation of the Coldcard drain yesterday, we identified an unusual pattern in the sweeps. That pattern led us to a hypothesis that has since been confirmed: the operator used a paid account at a well-known blockchain-services provider to query the source addresses and perform other related activity during the sweeps.」
Garrett added: 「We contacted the provider directly. Their internal logs matched the suspected workflow with extraordinary specificity, including the number, timing and sequence of requests. The provider was supplying its standard services in response to requests that did not reveal their broader purpose. We have seen no evidence that the provider knowingly participated in or facilitated the suspected theft.」
He also said, 「We are sharing the relevant information with the appropriate authorities. We will provide further updates when doing so will not interfere with the investigation.」
The report said Thorn and others have noted that later, smaller waves showed different operational patterns, including rapid and opportunistic drains followed by quick laundering. That has led to the view that additional actors may have reverse-engineered the same weak seed space after the original disclosure. Self-reported confirmed drains appear to have slowed sharply after August 6, but many seeds generated on affected firmware between 2021 and the July 2026 patch remain at risk until users migrate.
The bug that opened the door
Bitcoin Magazine said the speculation around an insider role stems in part from language Coinkite itself used years earlier. In October 2021, the official COLDCARD account described a 「retirement attack」 as a case 「when the project makers could have a ‘bug’ in the entropy generation for later retrieval.」
The 2026 vulnerability produced that exact outcome, the report said. Seeds were generated with far less entropy than intended, making them searchable years later. Some people in the Bitcoin community now suspect the hack may have been an inside job at Coinkite, while others reject that view. The article says the public record is still too thin to support any firm conclusion, and that stronger evidence may not emerge unless litigation later forces it into the open.
The critical code change entered the codebase on March 1, 2021, in a commit titled 「First pass w/ libNgU」 with hash b18723dd. That commit replaced remaining Trezor-derived cryptography and BIP-39 code with a new library, libngu, and rewired seed generation. The intended behavior was for randomness requests to resolve to the STM32 hardware true random number generator. Instead, the bug redirected the call to MicroPython’s Yasmarang software PRNG, causing what the report described as an effective entropy collapse to roughly 40 bits on older models and around 72 bits on newer ones. In practical terms, that made the Bitcoin private keys guessable with modern computing hardware.
The library swap was pushed into the codebase by Doc-Hex, also known as Peter Gray, Coinkite’s chief technical officer. Zach Herbert, founder and CEO of Foundation Devices, said the move was arguably influenced by licensing pressure. Coinkite disputed that as the primary reason and said: 「COLDCARD had to make this change to move to libsecp256k1; the license change is irrelevant to this. libsecp256k1 is the standard library used by Bitcoin Core.」
According to the article, Coldcard had been using Trezor-derived code under the GPLv3 open-source license. After Foundation Devices forked related material, Coinkite tried to move the remaining components to a more restrictive MIT + Commons Clause arrangement that limited commercial reuse. The rewrite was broad and technically ambitious, and the report argues that this integration is where the silent entropy-path failure slipped in.
Skepticism about moving away from the Trezor cryptography library surfaced early. On April 7, 2021, a member of the Coinkite Telegram group wrote: 「do we really want to replace the many-years-old TrezorCrypto code that has been heavily scrutinized by white hatters like Johoe and penetration tested by wallet.fail」 and added that 「switch may be a talented pseudonymous coder, but their commit history sucks.」 The criticism did not stick. NVK quickly dismissed the Trezor library as a 「shitcoin shitshow.」 The article notes the irony that the Trezor codebase, because it was shared under an open license across a wider crypto market, had received much deeper review than libngu ever did.
The Switch identity and Peter Gray connection
The article then turns to the origins of libngu. The cryptography library replacement that introduced the bug was pushed by Doc-Hex, Coinkite’s CTO Peter D. Gray. He swapped out the GPLv3 Trezor crypto library for Libngu, a little-known codebase created by a pseudonymous developer called Switch. Before libngu, the report said, that identity had no obvious public track record.
The Switch account appeared on X on August 3, 2019, with a post mentioning DEFCON. On October 16, 2020, Switch thanked Doc-Hex on X for merging code and wrote: 「Thanks for merge @DocHex I’m making yet another bitcoin library. Could be useful on @COLDCARDwallet someday.」 A few days later, Switch posted a link to Libngu and described it as a 「useful thing.」
What drew stronger attention later was a claim by Bitcoin Core contributor James O’Beirne that Switch and Peter D. Gray had signed code commits with the same GPG keys. O’Beirne said GPG commit signatures showed that dozens of commits attributed to switck were signed with the personal key of Peter D. Gray, Coinkite’s co-founder and CTO, who also operates as DocHex.
Zach Herbert separately claimed that phone numbers ending in the same two digits were tied to both the DocHex and switck X accounts. Other researchers pointed to matching DNS registration patterns. As of the time of writing, neither Gray nor Coinkite had publicly addressed the GPG signature findings, and the article said they did not respond to requests for comment.
The Switch account remains active. The report said code changes were merged into Libngu as recently as August 17, 2026. Some people in the Bitcoin industry see that as tangential evidence of wrongdoing. The article itself pushes back on that leap. It asks whether someone planning to exploit an RNG bug years later would really sign commits with a personal GPG key, and argues that the overlap between Gray and Switch, taken alone, does not establish much in the search for the Coldcard hacker. It may instead reflect a pseudonymous identity Gray created around DEFCON and kept using for selected projects. The report notes that pseudonymous identities are common enough in Bitcoin development circles.
MicroPython contributors also came under scrutiny
Bitcoin Magazine also reviewed code changes on the MicroPython side of the RNG path. Data analyst LaurentMT examined how the fallback was introduced. MicroPython is a lightweight open-source implementation of Python 3 built for microcontrollers and resource-constrained computers. Because of the Coldcard bug, firmware calls ended up reaching MicroPython’s Yasmarang PRNG fallback, producing low-entropy seeds.
The PRNG-related changes began on August 20, 2020, when a GitHub user named mirko opened issue #6347. He said his ESP32 hardware always returned the same result when random.choice() was called in a certain way, when he had expected random output. The issue thread went on for months, discussing how the logic and expected behavior should be handled. Mirko described the design as counterintuitive.
LaurentMT said robert-hh opened a pull request implementing a PRNG seeding change on August 22, 2020. Later, on October 29, 2020, MicroPython maintainer dpgeorge merged a slightly modified version into the master repository, using 「the (UID+SysTick+RTC) to address some limitations in robert-hh s solution.」
That put critical RNG-related changes into the master branch before MicroPython had issued a new official release, and before Coldcard forked it for use by libngu. The article says building on a moving master branch is generally considered risky compared with building on a stable release. MicroPython did not release the next version, v1.14, until February 3, 2021.
The release announcement only mentioned the RNG change briefly, stating that 「the urandom module will randomize its seed on import on stm32, esp8266, esp32 and rp2 ports.」 In comments to Bitcoin Magazine, LaurentMT said: 「without this modification the bug in Coldcard code would have been immediately detected.」 He also said there were many 「coincidences」 in the timeline and added that, while they prove nothing by themselves, he did not see how an official investigation could completely ignore them.
The report is explicit on one point: there is no evidence that any of the developers mentioned were intentionally trying to introduce the Coldcard RNG bug. It says responsibility for the implementation of the critical code sits with Coinkite, the hardware wallet company. MicroPython itself is a large and widely used open-source project.
Why the article says an inside job still looks unlikely
The report lays out several reasons it sees as cutting against a deliberate, years-long insider retirement attack. The switck identity was poorly compartmentalized, making attribution to Doc-Hex, or Peter Gray, relatively straightforward once researchers started looking. The account had also been largely dormant for years. The MicroPython contributors worked in the open on a highly visible project.
It also points to several technical reviews that stop short of alleging intent. Hodlonaut’s Citadel21 investigation and other technical reviews found no clear evidence that the entropy failure was deliberate. Engineer Alekos Filini wrote in his technical report: 「My goal is to purely present facts and NOT make any conclusions.」 Wizardsardine, in its technical autopsy, described the failure as sitting 「across a submodule boundary, which is precisely where reviewers stop looking.」 Steven Geller’s technical deep dive did not make strong claims in either direction. DK27ss, in a proof-of-concept reconstruction, described the issue as 「a chain of four flaws, each harmless in appearance.」
The article compares the situation with QuadrigaCX, which it describes as perhaps the last major long-con hack in the Bitcoin industry. The centralized Canadian exchange’s founder, Gerald Cotten, was reported dead in India in 2018 not long after the missing funds were discovered. The Ontario Securities Commission later accused the founders of misappropriating almost CAD 170 million in user deposits over many years before disappearing.
Coinkite, by contrast, remains publicly active, according to the report. Its leadership has been responding to the incident, shipping patched firmware, helping users migrate, and engaging on the technical details. The company’s founders and operators are still known and still running the business. At the same time, the more than 1,000 BTC from Wave 1 remains pooled in three addresses being watched by hundreds of engineers and likely by law enforcement including the FBI. The article argues that if Coinkite had been attempting a carefully planned retirement attack, the coins would almost certainly not have been left sitting in a handful of easy-to-track addresses.
The piece ends without a firm conclusion. It says investigations will likely run for years. Its author, Juan Galt, writes that the evidence so far points more to a cultural failure in the Bitcoin maximalist and self-custody community, including weak user and influencer education around open-source norms, and overconfidence by Coinkite veterans in their own engineering judgment.
