Bitcoin News
By James Thorp
1 / 15
How the Hacker Built 293 Multisig Vaults. What makes this exploit unusual isn't just the scale — it's the architecture.
2 / 15
The Firmware Bug That Started Everything. Go back to March 2021. That's when Coinkite, the company behind Coldcard, shipped a firmware…
3 / 15
A Possible Fourth Wave and $143.9M at Stake. Galaxy Research found something else while tracking all of this — a previously unknown vault tied…
4 / 15
The attacker behind the Coldcard hardware wallet thefts is moving fast. On September 2, the hacker started shifting funds — 97.09 BTC in total, worth roughly $7.
5 / 15
The mechanics of the move are worth breaking down. It didn't happen in one clean transfer. The hacker first pulled approximately 20.
6 / 15
So not all of it's gone. Not even close.
7 / 15
What makes this exploit unusual isn't just the scale — it's the architecture. The attacker built 293 two-of-two multisig vaults, each one set up to drain a specific victim's coins.
8 / 15
Right now, eleven of those vaults are fully drained. The next ten on the list hold a combined 30.81 BTC. The 233 smallest vaults collectively sit at 33.77 BTC.
9 / 15
Coinkite has since pushed out updated firmware. The new version forces users to add their own randomness through physical actions during setup, which basically patches the weak…
10 / 15
See also: 600 Bitcoin Moved After 16 Years; No Link to Satoshi Confirmed
11 / 15
Coinkite's CEO, Rodolfo Novak, issued an apology and said the company is committed to restoring user trust. A full technical postmortem is still pending. No timeline given.
12 / 15
Galaxy Research found something else while tracking all of this — a previously unknown vault tied to 58 addresses that looks like it belongs to another Coldcard victim.
13 / 15
And it could go higher. Back in August, Galaxy flagged a potential fourth wave involving 638.5 BTC. If that materializes, the cumulative total would push past 2,400 BTC.
14 / 15
That's either patience or caution. Maybe both.
15 / 15
The hacker's use of CoinJoin and THORChain together is worth noting on its own. CoinJoin obscures on-chain trails within Bitcoin.
The Currency Analytics
Want the full story?