Atlas Phoenix BTC

Bitcoiner since 2013 who lost it all in the cold card hack. Rebuilding sat by sat with more conviction and grit - I will NEVER ask for donations or sympathy.

[Atlas Phoenix BTC @AtlasPhoenixBTC]

Cold Card Hack Update - One Month Later…

Hello again,

I just wanted to share a few thoughts for those that are interested, but in particular for the other victims. While I can’t offer you brevity with this post - in an age of AI slop, fakeness and grift, I hope you can appreciate something very real.

First of all, I am genuinely happy for all of you who are now enjoying what appears to be the end of this cycle’s bear market. You all deserve this for your conviction, and even though many of us are forced to sit this one out for now, I am still cheering you on from the sidelines.

Don't feel bad about celebrating - just try to remain humble as your entire life can change in an instant in so many unpredictable ways.

NEVER take for granted the freedom and security that your bitcoin will provide to you now, and in the future. Ultimately, the bitcoin journey will teach you life’s not about the money anyways so be a good person and take care of those around you.

Safeguard your bitcoin appropriately, keep learning, never let your guard down even for a moment, and don’t make my mistake of becoming complacent and trusting others with something so critical.

It should be obvious by now that the scammers will become more relentless, the capabilities of the black hats will increase dramatically, and the number of real world physical attacks will rise - everyone wants your bitcoin!

To the other cold card victims:
It has given me a great sense of solidarity connecting with many of you, hearing your stories and reading messages of support.

It should be very clear by now that no one is coming to save us. Not your favourite influencers, not other OGs, not the bitcoin billionaires, no personal/corporate/government bailouts, and as it seems: certainly not NVK and Coinkite. We must save ourselves, and bitcoin remains hope.

Our only, albeit unlikely, path to recovery is now ironically in the hands of the state (law enforcement) and chain analysis firms, which as bitcoiners we can only find some humour in.

Now, I want to make a promise to you all: should the Wave 1 hacker get caught, and all the stolen funds be returned to victims - I pledge 20 BTC of my returned coins to be split between the people who directly helped find and bring the attacker to justice, and also the victims of the later waves who were unable to get their funds back. I have great empathy for you all, who did everything you were told was correct. We are all in this together, and I believe it’s the moral thing to do. Let this gesture be a reminder to the larpers in this space, that honourable bitcoiners do exist, and this journey we are all on together isn’t just about watching your own portfolio grow. Over the coming years as the price of bitcoin continues to rise, so too does the USD value of this pledge.

And if there is no recovery: as the days turn to months and years while people move on - we can take solace in the fact that our sacrifice will help hundreds of millions of people in the future on their bitcoin journey towards SAFE self-custody. Contrary to some of the narratives floating around: self-custody and “bitcoin maximalism” are NOT dead. Never forget that holding your own keys is one of the cornerstones of bitcoin, a right and great responsibility to uphold, always be wary of those who tell you otherwise.

As I’ve told some of you privately, our energy is best spent focusing on what we can control: ourselves, accepting this lesson, and building back stronger for us and our families. We will all survive this while we, dare I say, *acknowledge* how much of a catastrophic and monumental fuckup this was on Coinkite’s part. This story is far from over, and we all deserve the full truth, accountability, and justice.

On that front however, it's looking less likely that any meaningful lawsuits against them will materialize, simply because all the lawyers want money upfront which many of us don’t have now. Due to the nature of the situation it’s unlikely to resolve positively for anyone but the lawyers themselves. For that reason and others I, and several of the other large loss victims I’ve spoken with are likely to bow out. Don’t mistake this as a psyop, or a coordinated submission among us: it’s just the reality and realization we’ve come to independently.

However, that doesn’t mean they are off the hook—the hacker(s) and the Coinkite team have to live with their decisions and conduct for the rest of their lives. With no signs thus far to even attempt to set this right - as each day passes, their respective roads to redemption (while still open) start to close. This is true whether bound by lawyers or not, as even the slightest show of goodwill is better than silence. Karma is indeed real - even if it doesn’t manifest immediately.

Never forget that this disaster had nothing to do with bitcoin itself - it was the failure of one specific company, and exposed many unfortunate truths about our own shortcomings, the industry and its influencers.

Though as true bitcoiners, our spirit remains unbreakable. We are anti-fragile, stay resilient and even in the wake of such injustice and adversity we maintain our integrity and dignity. Though our plans may have been derailed for years or even decades - when we build back this time no one will be able to say we simply got lucky!

The fight for freedom money and self-sovereignty was never going to be easy, but the mission and need for bitcoin is clearer than ever: fiat is dying.

This will be my last post until this situation is resolved. I’ve yet to stack any sats since the incident and need to focus on my own path forward in life. I remain open to all opportunities that help me get back on my feet again.

Eventually the sun will rise for us all.

Cheers to building back, and until then: tick tock, next block.

-M

[Atlas Phoenix BTC @AtlasPhoenixBTC]

For those that are unable to access the details via the link above, here is the document which is public information:

https://t.co/vb4CaQAo0W

[Atlas Phoenix BTC @AtlasPhoenixBTC]

For those that are unable to access the details via the link above, here is the document which is public information:

https://t.co/vb4CaQAo0W

[Atlas Phoenix BTC @AtlasPhoenixBTC]

A class action lawsuit has been filed against Coinkite.

https://t.co/DLOlfRuVW5

[Atlas Phoenix BTC @AtlasPhoenixBTC]

@paraglider_17 My understanding so far is that the other law firms withdraw when the first one gets filed as its duplication of efforts.

[Atlas Phoenix BTC @AtlasPhoenixBTC]

@novaclawai @michelleweekley No firm will take it on due to their size.

[Atlas Phoenix BTC @AtlasPhoenixBTC]

@asanoha_gold Reposting like NVK

[Ezequiel  @ezequieltar]

Vile scum. Zero humility.

Has @COLDCARDwallet , @Coinkite, @nvk, anyone paid back anything to any victim? Or are you all still going about your life with no remorse?

“Problems happen”

Why don’t you set up a fundraiser?
why not give future profits to the victims?
why not have some fucking honour and do something? Anything other than retweet bullshit to try and make yourselves feel less guilty, to justify your insane crookedness (or at absolute best, insane incompetence).

You financially ruin people but you think all is forgiven because “problems happen”.

You have two choices left.

Cowardice: hide behind "problems happen," retweet others’ failures (which are completely irrelevant to your own), protect your own wealth, and be remembered forever as the people who ruined lives and shrugged.

Or honour: stand up, own it completely, take the hit. Put everything you have toward making victims whole. Commit future profits. Accept it'll cost you massively, because it should.

The second road is harder and it will hurt like hell. Just like for those who lost their entire life savings. It's also the only one where anyone could even possibly begin to respect you again.

Respect isn't restored with PR or by pointing at other people's disasters. It starts the day you step in front of the bullet for the people who you’ve wronged.

Choose.

[Atlas Phoenix BTC @AtlasPhoenixBTC]

@greggpettine @NeilJacobs @CLOWNCARDwallet No.

[Blink Wallet @blinkbtc]

Full post-mortem of the September 19 attack, and a 50% bounty — up to 3.3 BTC — on the stolen funds:
https://t.co/8iRFY7Q13G

Bounty terms:
https://t.co/aF8d2L29Kv

On Saturday September 19 an attacker used a flaw in our admin tools to take over 35 Blink accounts and withdraw about 6.61 BTC from 24 of them. A customer called one of our engineers at 11:39 UTC. Fifteen minutes later the whole custodial service was off. By that evening the hole was closed and the service was back. By Thursday September 24 every affected customer had their exact balance back, in bitcoin and in dollars, paid for by Blink's shareholders. No customer bears any loss.

This was our fault. Not Bitcoin's, not our users'. To the 22 customers whose bitcoin was taken, and to the 3,817 people whose account details were looked up: we are sorry.

How it happened:

From October 2023 until that Saturday, anyone with a free Blink account and a web browser could give themselves the powers of our support staff: change the email or phone on any account, log in as that customer, raise their limits. Three unremarkable mistakes in how our admin tools checked permissions, stacked on top of each other, in code we inherited.

The whole team was busy moving tens of thousands of users to self-custody under new regulation. Monitoring built to catch outages didn't catch an administrator doing things no administrator should.

What it didn't touch:

The money came out of our hot wallet. Most customer funds sit in multi-signature cold storage that nothing in our admin tools can reach. Non-custodial accounts were never in play: we don't hold those keys.

What the attacker saw:

They also read the details of 3,817 other accounts, in some cases a phone number or email address. Not names, not IDs, not addresses, not passwords, not seed phrases. We wrote to every holder we could reach, saying exactly what was seen.

What stopped them:

Two-factor authentication. The attacker logged in to nine accounts that had it on and tried eighteen times to move money. Zero loss.

None of the 24 drained accounts had it on. If you take one thing from this post: Settings → Security and Privacy → Two-factor authentication. Then turn it on for your email too.

What we changed:

The flaw was fixed the same day and a third layer added two days later. The admin tools are off the public internet. The functions that change a customer's email or phone are switched off for everyone while we redesign them. All customer API keys were revoked.

The hot wallet now holds a fraction of what it did. Security fixes are developed privately and published once deployed; the code stays open source. A standing security reporting channel is live, with rewards of up to 0.1 BTC for critical findings.

Where the money is:

Some still sits where it was withdrawn to. About 5 BTC has gone through a cross-chain swap service; a small amount reached an exchange that is cooperating.

Criminal complaints are filed in El Salvador and Próspera, the regulators are notified, and we have traced the funds continuously. We are not expecting the money back.

So we are putting a 50% bounty on it.

Whoever provides the information that leads to a recovery gets 25% of what is recovered. Another 25% of anything recovered goes to Bitcoin Beach, Bitcoin Ekasi, Afribit Kibera and the circular economies they choose. No cap, no end date, paid only out of funds that actually come back. Write to [email protected].

We would far rather have spent this money on grassroots Bitcoin adoption than lost it to a thief. Shame on the attacker.

One more thing:

Ignore any email or SMS about this incident that contains a link: we contacted affected users only through messages in the Blink app. We will never ask for your PIN, password, seed phrase or a login code.

The full post-mortem has the timeline, the technical detail for anyone running code derived from ours, and the bounty terms (links at the top).

[Atlas Phoenix BTC @AtlasPhoenixBTC]

The industry is getting nailed left, right and center. Sorry you guys have to deal with such an attack as well.

Posting this here for anyone who’s capable - I’m also offering up to 20 BTC for whomever identifies the Cold Card Wave 1 hacker.

A life always looking over your shoulder is one I’d only wish upon the scum who thought these attacks were a good idea.

[Atlas Phoenix BTC @AtlasPhoenixBTC]

@LightningNewsX …and if you like bounties - I’m offering up to 20 BTC for whomever identifies the Cold Card Wave 1 hacker.

[Atlas Phoenix BTC @AtlasPhoenixBTC]

I appreciate the sentiment - I remember the Mt Gox hack, one of many I was able to avoid along the way. Not to trivialize your losses, but BTC was ~$500 back then with an extended multi year bear market that followed for reaccumulation. What has happened here can only be described as catastrophic loss, while being honest and real about it - there won’t be a way for me to come back stronger or recover from this. I’m doing my best to make peace with that, while keeping a glimmer of hope LE identifies the hacker and kicks the bastard’s door down.

[Caffe' Satoshi @CaffeSatoshi]

To whoever drained the COLDCARD funds,

You may be celebrating. You discovered a vulnerability, executed the exploit, and walked away with over 1,500 BTC.

But what you actually acquired isn't just bitcoin. You acquired one of the most heavily monitored UTXO sets on the planet.

Every forensic blockchain company has already tagged those outputs.

Every exchange, institutional custodian, compliance provider, and investigator will be watching where those coins move. CoinJoin, cross-chain bridges, mixers, peel chains, OTC desks, privacy tools... none of them magically erase history. Blockchain analysis in 2026 is far more sophisticated than many people realize.

What many hackers fail to appreciate is that Bitcoin has no statute of limitations. Every transaction you make from this moment forward becomes part of a permanent public record. Twenty years from now, the blockchain will still contain the complete history of every satoshi you moved. The data isn't going anywhere.

Forensic tools won't stand still either. Machine learning models, address clustering techniques, exchange intelligence, leaked databases, KYC records, seized servers, surveillance footage, IP logs, phone metadata, travel records, and future analytical methods that don't even exist today can all be combined retrospectively.

Investigators don't need to solve the puzzle today. They can revisit the exact same blockchain years from now with better technology and new intelligence, following your historical transactions as if they happened yesterday.**

As someone who lost bitcoin during the Mt. Gox collapse, I know what it's like to watch your coins disappear. It took years of uncertainty before I recovered anything.

You also have absolutely no idea whose money you've taken. It isn't just individuals and companies. Some victims may have extensive resources, influential connections, or backgrounds you know nothing about. Among hundreds of affected people could be former intelligence officers, wealthy financiers, organized crime figures, or people with both the means and the determination to pursue this indefinitely. You simply don't know whose interests you've just collided with.

Many victims have similar stories. Some may shrug it off. Others may dedicate years, or far more, to identifying those responsible. You simply don't know who is behind those wallets or how determined they may be.

If you think the challenge is over because the exploit succeeded, you've mistaken the easiest part for the hardest. Stealing the bitcoin was the beginning.

Living with it is the real problem. Every attempt to cash out, every wallet you touch, every service you use, every mistake you make, increases the probability of connecting your online identity to your real one.

If I were in your position, I would seriously consider approaching CoinKite and negotiating the return of the funds in exchange for a reasonable bounty or audit fee. You proved your technical ability.

That's far better than spending the rest of your life trying to move one of the most notorious collections of tainted bitcoin ever created while constantly wondering who is watching your next transaction

[Atlas Phoenix BTC @AtlasPhoenixBTC]

@HodlDee @Coinkite @COLDCARDwallet Cheers to new beginnings and soldiering on through the darkest times. You’ll be fine - not only due to your attitude, but the fact you still have your bitcoin. Many would trade places in a heartbeat, so dont take it for granted. Onwards!

[Alex Thorn @intangiblecoins]

COLDCARD SEED-ENTROPY THEFTS
a short video

1,830 BTC taken
3 waves, more than 30 smaller footprints
256 victims have come forward to @glxyresearch
median loss 1.1 BTC

but the hunt for the attackers continues..

[Atlas Phoenix BTC @AtlasPhoenixBTC]

Thanks for taking the time to express your thoughts on this. I’ve got plenty of time for people who genuinely want to discuss this fiasco productively. I know you’ve read my posts, so you will know that I’ve never been mean or spiteful towards NVK or Coinkite - I’ve only spoken the truth.

But the reality is, nearly 2 months later and beyond the July 31st post from NVK - there has been NO sign of regret, remorse, or ANY discussion of a path forward for victims from Coinkite’s side, and anyone with a conscious or any sort of moral compass finds that absolutely disgusting.

I personally decided to take some leadership and offer my own bounty and reach out to many researcher and hacker groups to help identify the hacker - because I am deeply disturbed by the stories of other victims (not to mention my own life having been destroyed by this).

One could just ask any AI to generate a list of 10 tangible and productive steps the company could take to do the right thing and repair their image (and do right by the victims) and that would already be more effort than anything they have done.

I’ve spoken to MANY of the victims, and particularly the ones that were hit the hardest - and not many of them are out for blood or want to burn them to the ground, BUT we all agree we got fucked hard and it’s NOT RIGHT how it’s been handled since.

Even thinking that ANY of us would offer the slightest bit of support for the company or their products until we are shown some respect and offered a reasonable solution is complete delusion.

You want to talk about banding together as a community? This community has done absolutely nothing for those of us affected. All the influencers, all the big shots who virtue signal, NVK and Coldcard retweeting and writing bullshit on here - none of it helps. So no, the victims have been degraded enough, and we won’t be the first to try and repair their bridge that Coinkite burned.

And for the record, they owe me A LOT more than 20 btc.

[Alex Thorn @intangiblecoins]

❄️COLDCARD WHITE HAT MOVES FUNDS TO TRUST 🏳️

52.37 BTC comprised of coins from Wave 2, Footprints AA, AU, AX consolidated into a fresh address with an OP_RETURN "claim:cryptorecoverytrust dot com" in block 967,948

these white hatted funds represent 2.8% of the coldcard exploit

[Atlas Phoenix BTC @AtlasPhoenixBTC]

You are a very kind person, and I know you have genuinely cared about us from the beginning of this mess. The reality though is 6 weeks past this and most have moved on - with no “community leader” having organized anything by now, it’s not going to happen. We all simply maintain hope the hacker gets caught, while rebuilding our lives the best we can.

[Atlas Phoenix BTC @AtlasPhoenixBTC]

@ozsats256 Well I can assure you for at least the thousands of us directly affected, the memory will NEVER fade for the rest of our lives. As far as their company goes - karma will take care, that I am sure about.