Alex Thorn: Tracking the Stolen Bitcoin and the "Red Team" Racing to Find More Bug

— Over 1,700 Bitcoin worth approximately $112 million has been stolen from approximately 8,300 Coldcard wallet addresses through a five-year-old seed generation vulnerability.

— The attacks have occurred in multiple waves, with Waves 1 and 2 containing the largest amounts (over 1,000 and 1,200 Bitcoin respectively) and remaining largely unmoved since exploitation.

— A volunteer "Red Team" of Bitcoin developers is comprehensively auditing open-source Bitcoin software repositories using AI to identify similar vulnerabilities; they've scanned over 500 repositories and found no issues in LibSecP256K1 (Bitcoin's core signature math).

— The Coldcard vulnerability went undetected for five years partly because Coinkite became hostile toward the open-source community, discouraging code audits and vulnerability submissions.

— Alex Thorn has identified diverse threat actors—from organized early attackers to opportunistic copycats—and is working directly with victims to provide forensic reports and help them file claims with law enforcement.

— The exploit was likely operationalized using AI, and the Wave 1 attacker appears to have queried victim addresses through a blockchain data provider with a paid account, leaving traceable footprints.

— Coldcard holders must act immediately: If you used a Coldcard device (MK3 through MK5 or Q models) for single-signature self-custody and did not manually roll dice for entropy or use a strong passphrase, move your funds to a secure location—either a multi-signature setup with non-Coldcard signers, a regulated custodian such as River or Coinbase, or a different hardware wallet—as all vulnerable seeds will eventually be exploited. File a formal report to establish victimhood: Contact the FBI's Internet Crime Complaint Center (IC3) and reach out to Alex Thorn directly via X (@intangiblecoins) with your drained addresses to receive forensic reports and increase chances of recovery if funds are frozen or recovered by law enforcement; do not share personally identifiable information if uncomfortable doing so. Do not rush into panic moves if you are not affected: If you use Trezor, Ledger, or a multi-signature setup where not all signers are vulnerable Coldcards, remain calm and verify your actual exposure before making changes; rash migrations have led some to download scam wallets and lose funds unnecessarily.