{"id":76306,"date":"2026-08-03T10:23:53","date_gmt":"2026-08-03T10:23:53","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/zachxbt-refuses-to-trace-the-88m-coldcard-hack\/"},"modified":"2026-08-03T10:23:53","modified_gmt":"2026-08-03T10:23:53","slug":"zachxbt-refuses-to-trace-the-88m-coldcard-hack","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/zachxbt-refuses-to-trace-the-88m-coldcard-hack\/","title":{"rendered":"ZachXBT Refuses to Trace the $88M Coldcard Hack"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<div class=\"@container mb-[25px] rounded-sm overflow-clip py-0.5 pr-0.5 pl-2.5 bg-success-100\">\n<div class=\"flex flex-col gap-m overflow-clip rounded-[6px] !bg-success-10 p-3 @[420px]:p-m\">\n<h2 class=\"m-0 flex items-center gap-s text-[19px] !text-[#1c1c1c] md:text-[20px]\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"10\" viewbox=\"0 0 16 10\" fill=\"none\" class=\"shrink-0 text-success-100\" aria-hidden=\"true\"><path d=\"M1 1.5h14\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><path d=\"M1 8.5h10\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><\/svg><span>Key Takeaways<\/span><\/h2>\n<ul class=\"m-0 flex list-none flex-col gap-m pl-0\">\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">ZachXBT declined to trace the Coldcard hack, citing weak support from bitcoin holders.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Coinkite\u2019s Coldcard breach has drained 1,367 BTC from 4,585 addresses since July 30, 2026.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Galaxy Research is still tracking the stolen funds as Coinkite\u2019s email-retention policy draws fresh backlash.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2>ZachXBT Says He Has \u201cLess Obligation\u201d to Help<\/h2>\n<p>The prolific onchain investigator, known for unmasking hackers behind some of crypto\u2019s biggest thefts, <a href=\"https:\/\/x.com\/zachxbt\/status\/2084045834099057018\" target=\"_blank\" rel=\"noopener noreferrer\">posted on X<\/a> that he has no current plans to monitor or trace the Coldcard incident. He said his time is focused on ecosystems that value his work, adding that Bitcoin maxis are not donors or supporters of his investigations, so he has less obligation to help.<\/p>\n<figure id=\"attachment_836324\" aria-describedby=\"caption-attachment-836324\" style=\"width:1190px\" class=\"wp-caption aligncenter\"><figcaption id=\"caption-attachment-836324\" class=\"wp-caption-text\">Image source: X<\/figcaption><\/figure>\n<p>The remark landed as the Coldcard breach entered its fifth day and its running total kept climbing. ZachXBT has previously worked pro bono on major cases, and his post suggests there is a major divide between the goodwill Bitcoin\u2019s community has shown him and the effort he is asked to out forth when things go wrong.<\/p>\n<h2>The Coldcard Breach so Far<\/h2>\n<p>The exploit traces back to a firmware flaw in hardware wallets made by Canadian manufacturer Coinkite. The bug affected Coldcard Mk3 devices running versions 4.0.1 through 4.1.9, causing some wallets to generate seed entropy through a software random-number generator instead of the hardware\u2019s dedicated chip, a defect that made certain seeds guessable.<\/p>\n<p>The <a href=\"https:\/\/news.bitcoin.com\/crypto-news\/coinkite-warns-coldcard-mk3-owners-after-reports-of-38m-bitcoin-loss\/\">first wave hit on July 30 <\/a>when roughly 594 BTC, worth about $38 million at the time, drained from close to 500 dormant addresses in under 30 minutes. Coinkite pushed patched firmware within two days, but the damage kept spreading and by August 2, Galaxy Research had tracked the running total to 1,367 BTC, worth $88.6 million, pulled from 4,585 addresses across three separate attack waves.<\/p>\n<p>The pace and precision of the thefts fueled speculation that automated tooling, possibly AI-assisted, helped the attacker identify and drain vulnerable addresses within minutes of each sweep. The <a href=\"https:\/\/news.bitcoin.com\/crypto-news\/coldcard-theft-balloons-to-88m-as-exchange-deposits-spike-old-btc-moves\/\">theft continued to balloon<\/a> even as exchange deposits from the stolen funds spiked and older, previously dormant BTC linked to the case started moving again.<\/p>\n<h2>Data Retention Adds to the Backlash<\/h2>\n<p>Coinkite\u2019s <a href=\"https:\/\/news.bitcoin.com\/security\/coinkite-under-fire-for-retaining-customer-emails-after-88m-coldcard-hack\/\">handling of the aftermath<\/a> has become its own controversy given that the company emailed every customer address it could reach from its store and newsletter records, some dating back to 2019, to warn them about the bug.<\/p>\n<p>That contradicted earlier claims from CEO Rodolfo Novak that Coinkite erased customer data 90 days after a purchase and offered anonymous buying options. Coinkite later admitted it retains purchase email addresses indefinitely and acknowledged it lacks a deletion policy for that data, a disclosure that drew its own wave of criticism separate from the hack itself.<\/p>\n<p>Novak has defended the company\u2019s overall security record, noting that competitors face breaches regularly and that Coinkite takes the matter extremely seriously. Still, the episode has already started to erode faith in self-custody and could push more cautious investors back toward exchange-traded funds instead of managing their own keys.<\/p>\n<p>The saga has also spilled into onchain drama beyond the theft itself. A brazen <a href=\"https:\/\/news.bitcoin.com\/crypto-news\/coldcard-hacker-gets-brazen-bitcoin-laundering-offer-onchain\/\">bitcoin laundering offer<\/a> aimed at the hacker was posted directly onto Bitcoin\u2019s blockchain, turning the case into a public spectacle playing out in real time across social media and onchain data.<\/p>\n<p>With heavyweights like ZachXBT stepping back, the burden of tracing the stolen 1,367 BTC now falls more heavily on firms like Galaxy Research, which has been publishing wave-by-wave updates as the attacker\u2019s wallet activity evolves. Reports have surfaced that the entropy bug affecting Coldcard Mk3 devices dates back to a March 2021 firmware build, meaning any wallet seed generated on that version over more than four years could still be exposed until owners rotate to a fresh seed on the patched firmware.<\/p>\n<\/p><\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/security\/zachxbt-declines-trace-coldcard-hack\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways ZachXBT declined to trace the Coldcard hack, citing weak support from bitcoin holders. Coinkite\u2019s Coldcard breach has drained 1,367 BTC from 4,585 addresses since July 30, 2026. Galaxy Research is still tracking the stolen funds as Coinkite\u2019s email-retention policy draws fresh backlash. ZachXBT Says He Has [&hellip;]<\/p>\n","protected":false},"author":3947362404,"featured_media":76307,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/76306"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/3947362404"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=76306"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/76306\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/76307"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=76306"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=76306"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=76306"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}