#780: Dissecting The Coldcard Hack with Alex Thorn

— Coldcard vulnerability exploited across three distinct attack waves; Galaxy Research has tracked over 1,500 BTC stolen, with ~400 BTC directly confirmed by victims.

— Wave One (41 minutes, July 30 UTC) used a fixed 30 sat/vB fee pattern and consolidated victim funds through four collectors into three final addresses, all currently inert. Waves Two and Three identified via victim reports and pattern matching; Wave Three shows significantly more sophisticated topology with 293 independent transaction chains.

— AI-driven exploitation observed operationalizing the vulnerability; attackers queried addresses via paid blockchain infrastructure provider accounts, potentially enabling law enforcement identification.

— White-hat sweeping efforts underway by security researchers (Wicked Bitcoin, Rob Hamilton, others) to secure vulnerable funds; ethical and logistical challenges arise around proof of original ownership and fund recovery.

— Multi-sig adoption now positioned as essential infrastructure; single-signature cold storage model viewed as increasingly untenable; collaborative custody platforms (Casa, Unchained, Nunchuck, Anchor Watch) and open-source solutions recommended.

— Broader AI arms race between attackers and defenders; frontier model access restrictions limiting security researchers' ability to audit Bitcoin and critical infrastructure code; national security implications flagged.

— If you hold funds on Coldcard firmware versions 4.0.0+ (released March 2021 onward), move coins immediately. Game theory suggests accelerating attacks as exploit awareness spreads; delays increase risk. Retain your device for forensic evidence if funds are stolen.

— File a police report with local law enforcement, the FBI's IC3 (or equivalent in your jurisdiction), and contact Galaxy Research (X: @intangiblecoins) or other tracking teams with your drained transaction IDs. Early victimhood documentation is critical if funds are recovered; multiple parties now hold keys to stolen addresses.

— Transition to multi-sig collaborative custody for long-term self-custody security. Single-key hardware wallet models under mattresses are no longer sufficient; verified platforms offer institutional-grade security at modest cost and retain full sovereignty.