taken across all four waves
Public reportingColdcard: Bitcoin Wallet Drains
A firmware update left some hardware wallets choosing keys with weak randomness. 594 bitcoin arrived at one address, 562 moved once in a 341-input transaction, and it is still sitting there.
- Date
- July 30, 2026
- Network
- Bitcoin
- Reported amount
- ≈1,816 BTCin four waves, from more than 5,000 wallets
- What happened
- Weak key generation in old firmware
- Status
- No attribution
- This file rests on
- 8 recorded and 3 reported statementsacross 3 linked identifiers
6 chapters · choose one to jump the film to it
Replay it yourself.
These are the film’s own beats. Choose a time to jump the film there. Where a step rests on a record, open it in the workspace and read today’s capture of the same record.
The theft
Bitcoin starts vanishing from hardware wallets, the kind people buy so this cannot happen.
Reported by others- About 1,816 BTC left more than 5,200 wallets in four waves, roughly $116M.Public reporting
The cause
The cause was a bug from 2021. A firmware update left some wallets choosing their secret keys with weak randomness, so keys that should be impossible to guess could be guessed.
Reported by others- A 2021 firmware flaw reduced key randomness to as little as 40 bits.Public reporting
Search one: the collection address
Investigators published one address that collected coins. 594 bitcoin arrived there, 562 left again, and 32 is still sitting in it.
Recorded · captured October 5, 2026Opens a live lookup on the Summary view. Today’s capture may differ from the film’s.- 594.47728031 BTC funded.
- 562.02666941 BTC spent.
- A balance of 32.4506109 BTC across 165 unspent outputs.
Search two: the transaction
The 562 left in a single transaction: 341 inputs swept into one output. The numbers match to the last digit.
Recorded · captured October 5, 2026Opens a live lookup on the Summary view. Today’s capture may differ from the film’s.- Block 960,191. 341 inputs, 1 output.
- A fee of 0.0070464 BTC.
- The output of 562.01962301 BTC plus the fee equals 562.02666941 BTC, exactly what the first address spent.
Search three: the receiving address
The address that received it has been funded with 562 bitcoin and has spent none. The only activity since is dust: tiny deposits from strangers.
Recorded · captured October 5, 2026Opens a live lookup on the Activity view. Today’s capture may differ from the film’s.- 562.02148293 BTC funded, 0 BTC spent.
- 66 unspent outputs: one large, 65 dust.
The boundary
The record shows where the money sits. It does not show whose hands it is in, and the investigators who studied the case have not named anyone either.
Reported by others- No attribution has been made.TRM Labs
What the headline said. What a closer reading shows.
arrived at the one address this case follows
Recorded at the addressThe incident on one map
Who called what, and where it went.
Recorded in the workspaceReported by others
In the order it happened.
A firmware update introduces weak key randomness in some wallets.Reported by others
Bitcoin begins leaving affected wallets, in the first of four waves.Reported by others
562.02 BTC moves once, in a single 341-input transaction.Recorded
The receiving address has spent nothing. 32.45 BTC remains at the collection address.Recorded
The cast
Open the investigation ↗Every address and transaction in this case.
Grouped by their place in the records. A group says what an address did here, not who controls it. Supported identifiers open as live lookups.
Where it went
Addresses that received the value. Who controls them is not established here.
- The collection addressBitcoin address
594 bitcoin arrived here. The first search in the film.
- The receiving addressBitcoin address
562 bitcoin funded, none spent in the film's capture.
The transactions
The individual records each step of the case rests on.
- The consolidationBitcoin transaction
341 inputs, one output. Its output plus its fee equals what the first address spent.
Two kinds of statement, kept apart.
Recorded statements were read in the workspace on October 5, 2026. Reported statements come from the source named beside each one and were not verified by Forensia. A record is not proof of who owns either side.
What the chain records8
- Step 3
594.47728031 BTC funded.
- Step 3
562.02666941 BTC spent.
- Step 3
A balance of 32.4506109 BTC across 165 unspent outputs.
- Step 4
Block 960,191. 341 inputs, 1 output.
- Step 4
A fee of 0.0070464 BTC.
- Step 4
The output of 562.01962301 BTC plus the fee equals 562.02666941 BTC, exactly what the first address spent.
- Step 5
562.02148293 BTC funded, 0 BTC spent.
- Step 5
66 unspent outputs: one large, 65 dust.
What others have reported3
Share and cite
Take the case with you.
The brief is one page: the steps, the timeline, every identifier, and which statements are recorded and which are reported.