Coldcard2026-08-13 21:39:17Coldcard Attacker Ranked Addresses by Balance, Left 132.95 BTC in 153 Stolen AddressesNew research flagged by Bitcoin News shows the Coldcard attacker identified vulnerable addresses, ranked them by bitcoin holdings, and began moving funds from the largest balances first. The transfer tool used appears crude: from one address with 225 spendable UTXOs, it pulled only the newest 200 and left the oldest 25, including a 0.16 BTC UTXO. That matches the default 200-record limit of a blockchain API the researchers looked at, suggesting the attacker may have failed to load the next page of data. The software even spent a 294-satoshi UTXO, reportedly adding about 2,040 satoshis in fees. While the attacker likely obtained full seeds, at least 75 BTC remain in other addresses derived from the same seeds, and 132.95 BTC still sit across 153 compromised addresses. Researchers cannot reproduce the seeds behind those addresses, and have not ruled out access to unpublished private device data or candidate data.1510
Coldcard2026-08-03 04:34:30Jonathan Goodman says Coldcard attack cost him about C$1.6 millionCanadian author and entrepreneur Jonathan Goodman said he lost about C$1.6 million in a Coldcard wallet attack. He said he is filing a police report and has also submitted a report to the Ontario Securities Commission. Foresight News noted that Goodman originally came from the fitness industry before shifting into writing and entrepreneurship focused on habits and lifestyle. His content, according to the outlet, is known for a practical, candid and family-oriented style. The incident was cited as a 7x24 newsflash item, with the claim linked to Goodman’s post on X.1750
Coldcard2026-08-03 00:52:28Galaxy research head flags suspected fourth organized Coldcard attack affecting 462 addressesGalaxy’s head of research said monitoring points to what appears to be a fourth organized attack tied to Coldcard, with similar transactions still sitting in the mempool awaiting confirmation. Previously confirmed transactions showed Replace-By-Fee, or RBF, enabled. During blocks 960,778 through 960,792, roughly a 2.5-hour span, 218 transactions were recorded. Those transactions involved 462 victim addresses, 216 new destination addresses, and 388.92748828 BTC. The monitoring also found that none of the transactions used inputs older than the Coldcard firmware boundary. The sweep rate during that window reached 13.8 per block, compared with 0.3 per block in the pre-incident comparison window, about 45 times higher. In terms of topology, the transactions followed a 1:1 pattern, with each victim address mapped to a new destination address. Only one destination address received two sweeps, and no consolidation address appeared. Some of the funds have already moved on to second-hop addresses.1740
SecondFi2026-06-25 10:37:00SecondFi Identifies and Isolates Two Attacker Addresses in Cardano Wallet Breach, 4.02 Million ADA Flagged and MonitoredCardano 钱包服务商 SecondFi 就近日发生的自动化攻击事件发布最新动态，称已锁定两名攻击者的相关地址。6月21日至23日期间，攻击分三波进行，其中攻击者A在两次批量操作中盗取171个钱包，攻击者B在第三波攻击中盗取203个钱包。SecondFi 公布了Collection地址和stake key，约402万ADA仍留在攻击者B的地址中，现已被标记并处于链上监控状态。团队正审查所有相关情报。1980
