@kimstrodamus@americanhodl8 Same. The product was so shit I stopped using it for other wallets.
The shillers touting it as the best wallets need to be studied.
At this time, the funds identified in this wave are sitting in 4 addresses:
bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r
bc1qx76cae2706qd5q576feh7xq8rfcsjpf2htfhe3
bc1q8jy96fe5lf8vfugydnte3cguk92gpev7kwtp3q
bc1qnk4zh9qcnap2mycp56qjrgza3cc8ylrh8fecp0
We are monitoring these addresses.
We mapped the flow of funds for the Coldcard vulnerability based on the pattern identified by engineers at Block and shared by @clay_garrett
1,196 addresses drained in full for 1,082.65 BTC (~$70.2M) between 01:10:20 and 01:51:26 UTC on Jul 30 — a 41-minute window, blocks 960,183-960,191. That preceded the hardware-wallet vendor's public advisory by ~30 hours.
Signature: every sweep paid an identical hardcoded 30.0 sat/vB — a 30-75x overpay vs the 0.4-1.0 sat/vB median that week — and left no change output. That looks like an automated tool spending keys it already held, not owners moving funds. Victims: 1,183 native segwit (BIP-84), 7 BIP-49, 6 BIP-44 — consistent with multi-path key scanning.
Proceeds consolidated within minutes and have NOT moved since:
- bc1qq85v2c9...cu9r — 562.02 BTC
- bc1qx76cae2...fhe3 — 398.48 BTC
- bc1q8jy96fe...tp3q — 89.62 BTC
- bc1qnk4zh9q...fecp0 — 32.45 BTC (unmoved)