Comprehensive database of Coldcard attacker and victim addresses compiled from Bitcoin block data.
Security & Exploits ·
A comprehensive database of addresses linked to Coldcard wallet compromises has been compiled from Bitcoin block data, documenting attacker holdings and drained wallets across multiple waves of activity. The dataset separates four distinct waves: waves 1–3, which align with earlier Galaxy Research documentation and total 1,366.3865 BTC across 4,583 drained addresses and 596 attacker addresses, and wave 4, a separate incident involving 64.90373764 BTC from 795 drained addresses consolidated into a single output in block 960,668 on August 2, 2026.
The mechanics differ markedly between waves. Waves 1–2 used collector addresses that swept victims into holding wallets; wave 3 employed a park-and-vault structure where fresh addresses staged funds before moving them into P2WSH scripts. Wave 4's single consolidation transaction drew from 795 independent wallets with no address, fee, or destination overlap to the earlier waves, suggesting either a different operator or a significant tooling change. All identified holdings remain unspent and have not entered exchanges or mixing services.
Whether waves 1–3 and wave 4 represent a single attacker or separate actors remains indeterminate from the chain data alone. The analysis does not confirm or rule out additional unreported activity, and the dataset recommends direct wallet verification rather than reliance on any external list.