Federal law enforcement may have identified the attacker responsible for draining over 1,000 Bitcoin from Coldcard hardware wallets in July 2026, according to public statements from blockchain engineers investigating the theft. The development raises questions about security practices across the hardware wallet sector and highlights ongoing challenges in open-source code review processes that affect developers throughout the industry.
Investigation Points to Known Identity
Block's engineering team traced the attacker's on-chain activity to a paid account at a major blockchain data provider. Clay Garrett, engineering lead at Block working on Bitkey, stated that the provider's internal logs matched the theft pattern with "extraordinary specificity, including the number, timing and sequence of requests." The relevant information has been shared with authorities.
The stolen funds from the first wave—1,082.65 BTC—remain untouched in the attacker's addresses, potentially enabling recovery for victims. Galaxy Research's Alex Thorn confirmed that confirmed and estimated losses across multiple waves exceeded 1,800 BTC from more than 5,000 addresses, totaling roughly $118 million.
The vulnerability stemmed from a firmware bug introduced in March 2021 that reduced encryption entropy to searchable levels—approximately 40 bits on older models and 72 bits on newer ones. The flaw remained undetected for over five years, affecting devices running firmware 4.0.1 onwards.
Technical Failures and Code Review Gaps
The bug entered Coldcard's codebase during a March 2021 commit that replaced Trezor-derived cryptography with a new library called libngu. The change redirected randomness calls from the STM32 hardware's true random number generator to MicroPython's software-based Yasmarang PRNG instead.
Multiple engineers have documented the cascade of failures that enabled the vulnerability. Wizardsardine's technical autopsy described the issue as sitting "across a submodule boundary, which is precisely where reviewers stop looking." Security researcher DK27 characterized it as "a chain of four flaws, each harmless in appearance."
Concerns about the cryptographic library migration were raised in Coinkite's Telegram group as early as April 2021, with one member questioning the replacement of "many-years-old TrezorCrypto code that has been heavily scrutinized." The warnings proved insufficient.
Implications for Blockchain Security Professionals
This incident underscores critical needs across the blockchain industry. Organizations developing custody solutions require robust code review processes, particularly when integrating cryptographic libraries or making foundational architecture changes. The failure occurred despite Coldcard's reputation and established market presence, demonstrating that no team is immune to oversight failures.
For security engineers and developers, the case illustrates how vulnerabilities can persist across library boundaries and through multiple review cycles. The MicroPython changes that contributed to the issue were merged before an official stable release, highlighting risks in building on evolving master branches rather than stable versions.
As the industry matures, companies will likely increase investment in security auditing roles and formal verification processes. Professionals with expertise in cryptographic implementations, hardware security, and multi-layered code review methodologies should see sustained demand. The incident also reinforces the value of transparent incident response—Coinkite has remained engaged throughout the investigation, assisting user migrations and shipping patched firmware rather than disappearing as occurred in previous industry frauds like QuadrigaCX.
