Coldcard hack: where the bitcoin is now — 1,038.85 BTC still on four addresses, 649 ETH into Tornado Cash

Coldcard is a hardware wallet. One firmware build from 2021 could, under some conditions, fall back to a predictable software routine when generating a wallet seed. Seeds made that way can be guessed. Anyone who created a wallet on an affected device and kept using that seed — even years later, even after updating the firmware — had coins an attacker could simply recompute the keys for.

The first sweeps landed on 30 July 2026. According to Galaxy Research the theft came in three waves by what look like different operators, about 1,806 BTC from 8,865 addresses in total. Those totals and the wave structure are Galaxy’s; the readings below are ours, from the chain, on 2 October 2026 at block 969,621.

The first wave was two transactions eight minutes apart. At 01:43 UTC on 30 July, 491 inputs were swept into bc1qx76cae2706qd5q576feh7xq8rfcsjpf2htfhe3: 398.48 BTC. At 01:51 a second collector, bc1qnk4zh9qcnap2mycp56qjrgza3cc8ylrh8fecp0, which had gathered 594.48 BTC, sent 562.02 BTC on to bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r in a single transaction with 341 inputs. The next day 1,212 small inputs were swept into bc1qtfrwa4j6rmj9rsgspv6a0yjumkg39js2numu75: 45.90 BTC.

None of those three addresses has spent a satoshi since. Today they hold 562.02, 398.48 and 45.90 BTC; the collector bc1qnk4zh9qcnap2mycp56qjrgza3cc8ylrh8fecp0 still holds the 32.45 BTC it did not forward. Together: 1,038.85 BTC on four addresses. The only activity since is incoming dust — transfers of a few hundred satoshi from strangers, the kind people send to attach a message.

Bitcoin has no issuer and nothing here can be frozen. But coins that sit still can be watched, and every exchange that screens deposits can refuse them. That is the practical value of the list: these four addresses are where more than half of the stolen bitcoin is.

The third-wave operator worked differently: instead of one big collector, each victim’s coins went into its own two-of-two multisig vault — 293 of them, by Galaxy’s count. Those sat still for a month. On 2 September the largest, bc1qt8rrtnxlszm7rcdjpeepzk076jd5hevakqerzjyxpk8u3p6dfh2q92ua36 with 20.50 BTC, was opened and sent to a staging address, bc1qgw8v0fa7877ntrueghhz5tyc8lah8hm5phvsmu.

From there the coins were swapped to ether through THORChain in eight swaps between 2 and 3 September — 20.15 BTC in, 649.24 ETH out, all delivered to one new Ethereum address, 0x160a7A4c067B084F03400c6980Ac29F73F6782f6. Several attempts were refunded by THORChain and retried, which is why the swap amounts look irregular. The address and the 20.15 BTC were reported publicly at the time; reports then described the ether as held there.

It was not held for long. Starting at 18:03 UTC on 3 September the address made 73 deposits into Tornado Cash — 64 of 10 ETH and 9 of 1 ETH, 649 ETH — and finished at 09:14 UTC on 4 September. The address is now empty. On this leg the trail ends at the mixer.

Galaxy reports that the same operator later sent further vaults into Bitcoin coinjoin rounds rather than across to Ethereum. We did not follow those.

Not everyone who swept vulnerable wallets was a thief. White-hat researchers raced the attackers and moved coins out of weak wallets before they could be taken. On 21 September at 05:45 UTC those coins were gathered into one transaction: 20 inputs, 52.37 BTC, paid out into 478 separate outputs — from fractions of a bitcoin up to 8 BTC, which looks like one output per rescued wallet. The transaction carries a message written into the chain: claims:https://cryptorecoverytrust.com.

That is the Crypto Recovery Trust, a Wyoming trust set up to hold recovered coins while ownership is checked. Its adviser, the law firm Steptoe, said a first 20 BTC was returned to a verified owner on 23 September with no fee. The chain agrees: thirteen of the 478 outputs, 20.00 BTC, were spent that day and ended on 19dN7MhMEw9H5HiXTGYEspaAfM3SBZWpY2, where they still sit.

The other 467 outputs — 32.37 BTC — have not moved. If your wallet was created on an affected Coldcard and was emptied, it is worth checking whether it was emptied by a thief or by the white hats: the second case means your coins exist and can be claimed.

A warning that matters here. Everybody who lost coins in this incident is now a target for fake “recovery” services. Nobody legitimate needs your seed phrase, and nobody can pull coins back out of an attacker’s address for a fee. We have not tested the trust’s claims process and cannot vouch for it; what we can say is that the on-chain message, the amounts and the first payout match what was announced.

It names nobody and does not say who controls any address. “Attacker address” here means an address that received swept coins and is listed as such by Galaxy Research; “white hat” means the coins ended in the transaction that carries the trust’s claims message. The total loss, the number of victims and the wave structure are Galaxy’s figures, not ours. Balances are as of block 969,621 on 2 October 2026 and will go stale the moment these coins move.