Pinned Tweet
Don’t talk bullshit about wallets being drained. If anyone’s wallet has been drained, provide proof of the transaction here. If there’s no proof, I’ll consider it a hoax.
NETERN retweeted
The Wall Street Journal just asked me how I felt the moment that I discovered $1.6M in Bitcoin had been stolen from me."
--
Surprisingly stoic. If anything, empowered. I never thought I’d be the victim of a robbery—let alone a million dollar robbery. Nobody does. But it happened. After telling my wife, I went for a walk. I thought I was going to feel horrible or hopeless. Instead, all I could think was that there wasn't anything I can do but to keep moving forward.
It was at that point that I found myself simultaneously sad for everybody else affected and grateful to be an entrepreneur. I'm confident in my skills to recover and, in a (very) weird and (admittedly) hardy way, immediately viewed this terrible thing that happened to me as a test to overcome––a part of my story.
Everything in the universe is frequency, and its transmission contains different speeds in every dimension.
i continue to investigate and add new Coldcard victim and attacker addresses to our investigation database tonight
THE ATTACK IS ONGOING -- move your funds off Coldcard-generated addresses immediately if you have not done so. i will provide additional updates on estimated numbers of impacted addresses via @glxyresearch soon
if you are affected, please DM me. many attacker addresses have only been found and documented because victims have the courage to speak up and share information. these reports are genuinely useful and don't just help me report to authorities but can help other users who may not even know their funds were stolen. many have dm'd me and i will answer every single one ✍️
the coins that were stolen in the wave 1, 2, and 3 patterns that we documented on @glxyresearch's page are still inert and sitting in the attacker addresses. those attacks look programmatic -- deliberate, planned, similar or identical transaction profiles, probably LLM orchestrated, with large piles sitting inert. others have not been so lucky. some thefts appear like one-offs; some of those sophisticated and some not. some have endless peel chains, some sending to cross-chain services like ThorChain, ending up in offshore casinos
the pattern is clear. wave 1, 2, and 3 were three big waves with distinct patterns. not one coin identified in those attacks has moved from its attacker holding address. but smaller, newer, opportunistic operators are clearly emerging to siphon and launder within hours
the attack is still ongoing. it's absolutely true that every single-sig Coldcard address generated after firmware upgrade in march 2021 will eventually be drained. it is only a matter of time. migrate your funds if you have not already
this hurts so much because these are exactly the people who did everything right. they stacked sats. they used the bitcoiners' favorite hardware wallet. Coinkite made blockclock, opendime, some of the coolest bitcoin hardware out there. i'll never understand how the entropy leak wasn't discovered sooner.
while all thefts are abhorrent and devastating, this cultural demographic was saving money. they weren't depositing into exchanges to speculate, or even doing much of anything in defi. they were saving their money the way bitcoiners have taught them to do for years. the average dormancy of stolen coins prior to theft is 3.18 years, median is 3.55. these are hodlers and it hurts
another thing i want to point out, which @Rob1Ham wrote about too: the US LLM models are thwarting many of our efforts. having to revert to an open source chinese model to protect or even just TRACK users' stolen funds is truly insane in America. huggingface encountered the same thing trying to defend from the openAI "lab leak." this needs to change and i will raise this at the highest levels i can access in government and industry
we will get through this. the vast majority of coins i have found are sitting inert. we are tracking them, and we've shared the addresses with all relevant US authorities and industry contacts. if you have lost funds, know that money isn't everything in life. work hard and thank god for the beauty in this world. this sickening feeling will pass. and if we all work together, we still have a chance to recover a lot of these funds
this is a blow to bitcoin self-custody and we need to do better as a community: with security, with education, and with being realistic about complexity, expectations, and recommendations we make to friends, family, and the public
I’m sorry this happened. If you share your wallet address and the transaction hash, I can help analyze the on-chain activity, trace where the 2,447,000 wFLR went, and review whether the transaction was authorized or the result of a compromise. We’ll also identify any realistic recovery or reporting options.
