Law enforcement may already know who emptied more than 1,000 bitcoin from Coldcard wallets in the first and largest wave of the July 2026 drains. Block’s investigation says it traced the attacker’s on-chain sweeps to a paid account at a major blockchain data provider, and that the provider’s internal logs matched the theft pattern with “extraordinary specificity.”

PSA: The attack is ongoing and is targeting weak private keys generated on devices as old as the MK2 with firmware 4.0.1 and later. If you may have one, double-check it and move funds as soon as possible. See the Coinkite advisory and status page.

The coins from that first wave — 1,082.65 BTC — remain untouched in the attacker’s address. That has left open the possibility that victims could recover at least some of the stolen funds. The key question now is who the hacker is, and whether the same trail points to a sophisticated outsider or to something closer to the insider “retirement attack” Coinkite itself once warned about.

The stakes extend beyond Coldcard’s own users. Coldcard devices, made by Coinkite, are among the better-known hardware wallets marketed for holding bitcoin in self-custody, with private keys generated and stored offline rather than on internet-connected servers. A flaw in the randomness used to generate those keys strikes at the foundation of that model itself.

What We Know

On July 30, 2026, an attacker began systematically draining bitcoin from Coldcard hardware wallets that had generated seeds under vulnerable firmware, a bug that went unnoticed for years. The first and largest wave moved 1,082.65 BTC. Additional waves followed, with estimates above 2,000 BTC. Alex Thorn of Galaxy Research has tracked the activity using on-chain pattern analysis and voluntary victim reports. By early August, confirmed and estimated losses across multiple waves exceeded 1,800 BTC from more than 5,000 addresses, although the final total is still being refined as new reports come in. In dollar terms, roughly $118 million has been confirmed stolen.

Thorn has publicly said law enforcement may already have a concrete lead on the operator behind the largest tranche. In a Bitcoin Policy Institute segment hosted on the Bitcoin Magazine YouTube channel, Thorn said: “Wave one’s identity, attacker identity, may be known to law enforcement.” He added that Wave 1 remains the largest single chunk identified so far, with the coins still sitting in the attacker’s address, and said Wave 2 appears similar enough that it may involve the same actor. Wave 2 adds another 76 or so bitcoin to the total.

The main source for the claim that the hacker’s identity might be known is Clay Garrett, engineering lead at Block working on Bitkey. On July 31, 2026, Garrett posted the findings of Block’s investigation:

“During our investigation of the Coldcard drain yesterday, we identified an unusual pattern in the sweeps. That pattern led us to a hypothesis that has since been confirmed: the operator used a paid account at a well-known blockchain-services provider to query the source addresses and perform other related activity during the sweeps.”

“We contacted the provider directly. Their internal logs matched the suspected workflow with extraordinary specificity, including the number, timing and sequence of requests. The provider was supplying its standard services in response to requests that did not reveal their broader purpose. We have seen no evidence that the provider knowingly participated in or facilitated the suspected theft.” Garrett said, adding: “We are sharing the relevant information with the appropriate authorities. We will provide further updates when doing so will not interfere with the investigation.”

For investigators, the finding is significant because it bridges the gap that usually separates on-chain theft from a real-world identity: the sweeps were tied to a paid account whose request logs — the number, timing and sequence of queries — were retained by the provider, creating an off-chain paper trail that Garrett says Block is now sharing with the appropriate authorities.

Thorn and others have said later, smaller waves show different operational patterns — including rapid, opportunistic drains followed by quick laundering — suggesting that additional actors may have reverse-engineered the same weak seed space after the initial public disclosure. Self-reported confirmed drains appear to have slowed sharply after August 6, although many potentially vulnerable seeds generated on the affected firmware between 2021 and the July 2026 patch remain at risk until users migrate.

A Retirement Attack?

The nature of the failure has fueled conspiracy theories about insider attacks, which Coinkite itself once discussed publicly. In October 2021, the official COLDCARD account defined a “retirement attack” as a situation “when the project makers could have a ‘bug’ in the entropy generation for later retrieval.” The post remains available here.

The 2026 vulnerability produced exactly that outcome: seeds were generated with far less entropy than intended, making them searchable years later. Some people in the Bitcoin space now believe the hack may have been an inside job at Coinkite, while others disagree. The public evidence remains too thin to reach a definitive conclusion, and further evidence may not emerge for years, likely only through litigation.

The critical change entered the codebase on March 1, 2021, in a commit titled “First pass w/ libNgU” (b18723dd). That commit replaced remaining Trezor-derived cryptography and BIP-39 code with a new library, libngu, and rewired seed generation. The intended result was that the randomness call would resolve to the STM32 hardware’s true random number generator. Instead, the bug redirected the call to MicroPython’s software Yasmarang PRNG, causing an effective entropy collapse to roughly 40 bits on older models and around 72 bits on newer ones. That meant the bitcoin private keys generated were effectively guessable by modern computing hardware. For scale, a properly generated Bitcoin seed is expected to carry 128 to 256 bits of entropy, so a collapse to roughly 40 bits shrinks the space an attacker must search by many orders of magnitude — the difference between keys that are practically unguessable and keys that can simply be enumerated.

The swap was pushed to the codebase by Doc-Hex, also known as Peter Gray, the Chief Technical Officer of Coinkite.

The move may have been driven by licensing pressure, according to Foundation Devices CEO and founder Zach Herbert, though Coinkite has denied that licensing was the primary motivation for the code change, saying, “COLDCARD had to make this change to move to libsecp256k1; the license change is irrelevant to this. libsecp256k1 is the standard library used by Bitcoin Core.”

Coldcard had been using Trezor-derived code under the GPLv3 open-source license. After Foundation Devices forked related material, Coinkite sought to move remaining components to a more restrictive MIT + Commons Clause arrangement that limited commercial reuse. The rewrite was large and had complex engineering goals; that integration appears to have left the silent failure in the entropy path.

Skepticism about the migration away from the Trezor crypto library surfaced as early as April 7, 2021, when a member of the Coinkite Telegram group wrote: “do we really want to replace the many-years-old TrezorCrypto code that has been heavily scrutinized by white hatters like Johoe and penetration tested by wallet.fail”, adding “switch may be a talented pseudonymous coder, but their commit history sucks.” The concern was quickly waved away by NVK, who called the Trezor library a “shitcoin shitshow.” Ironically, the broader use of that open codebase meant it likely received far deeper review than Libngu ever would.

Switch and Peter Gray, aka Doc-Hex

The cryptographic-library swap that introduced the bug was pushed by Doc-Hex, Coinkite’s CTO, Peter D. Gray. He replaced the GPLv3 Trezor cryptography library with Libngu, a little-known codebase created by “Switch,” a pseudonym that had no obvious prior history before Libngu.

The Switch account first appeared on X on August 3, 2019, with a mention of DEFCON, the international hacker conference often attended by cybersecurity engineers. On October 16, 2020, Switch thanked Doc-Hex on X for merging his code: “Thanks for merge @DocHex … I’m making yet another bitcoin library. Could be useful on @COLDCARDwallet someday.” A few days later, Switch posted a link to Libngu, saying he had built a “useful thing.”

According to research by Bitcoin Core contributor James O’Beirne, however, Switch and Peter D. Gray appear to have signed code commits with the same GPG keys. O’Beirne showed through GPG commit signatures that dozens of commits authored as switck were signed with the personal key of Peter D. Gray, Coinkite co-founder and CTO, who also operates as DocHex. Zach Herbert also said that phone numbers ending in the same two digits were tied to both the DocHex and switck X accounts (post). Other researchers pointed to matching DNS registration patterns.

Neither Gray nor Coinkite has publicly addressed the GPG-signature findings as of this writing, and they did not respond to requests for comment. The Switch account remains active and had merged code changes to Libngu as recently as August 17, 2026.

Some people in the Bitcoin industry have treated this as circumstantial evidence of wrongdoing. But the connection alone is not conclusive. If Gray had really intended to use the RNG bug to exploit Coldcard users, it is unclear why he would have signed commits with his personal GPG key. A hidden bug that sat dormant for years would also seem to conflict with using a throwaway nym in a traceable way. Pseudonymous identities are common in Bitcoin developer circles, with Satoshi as the best-known example. On its own, the Gray-Switch link does not appear to settle the hunt for the Coldcard hacker.

MicroPython Contributors

Several other open-source developers have also been identified as having touched or influenced code that played a role in the Coldcard RNG bug.

Data analyst LaurentMT examined the MicroPython side of the RNG path. MicroPython is a lightweight, open-source implementation of Python 3 designed for microcontrollers and other resource-constrained computers. Because of the bug, Coldcard firmware ultimately called MicroPython’s Yasmarang pseudo-random number generator fallback, which led to low-entropy generation.

Work on the PRNG logic in MicroPython began on August 20, 2020, when a GitHub issue, #6347, was opened by a user named “mirko.” He said his ESP32 hardware was always returning the same result when calling random.choice() in a certain way and expected random results instead. The issue triggered months of discussion about the proper logic and expected behavior, which Mirko showed to be counterintuitive.

Laurent noted that “robert-hh initialized a [Pull Request] implementing the PRNG seeding change” on August 22, 2020. Later, on October 29, 2020, dpgeorge, a MicroPython maintainer, merged a slightly modified version of that pull request into the master repository, implementing “the (UID+SysTick+RTC) to address some limitations in robert-hh’s solution.” The relevant RNG code was therefore on MicroPython’s master repository when Coldcard forked it for use in Libngu, but before MicroPython had released an official new version.

That matters because building on a repository’s master branch can be risky: the code may still be evolving, unlike an official stable release. MicroPython’s next release did not arrive until February 3, 2021, with version v1.14. Even then, the RNG change was only briefly mentioned in the release announcement, which said “the urandom module will randomize its seed on import on stm32, esp8266, esp32 and rp2 ports.”

In an interview with Bitcoin Magazine, Laurent said that “without this modification the bug in Coldcard code would have been immediately detected.” He also said that “there are a lot of ‘coincidences’ in this timeline,” adding that “while they don’t prove anything, I don’t see how an official investigation may completely ignore them.”

It is important to note that there is no evidence any of the developers mentioned above intentionally tried to introduce the Coldcard RNG bug. Ultimately, Coinkite, the hardware wallet company, is responsible for its implementation of the critical code. MicroPython is also a large, widely used open-source project. Even so, the sequence of events amounts to what may be described, for now, as a tragic comedy of errors.

Why an Inside Job Appears Unlikely

Several factors argue against a deliberate, long-planned insider retirement attack. The “switck” identity was poorly compartmentalized, and the shared GPG key and other overlaps made attribution to Doc-Hex, aka Peter Gray, relatively straightforward once researchers looked. The account had also been largely inactive for years. The MicroPython contributors, meanwhile, were working openly on a high-visibility project.

Hodlonaut’s Citadel21 investigation and other technical reviews found no clear evidence that the entropy failure was intentional. Engineer Alekos Filini’s technical report explicitly says, “My goal is to purely present facts and NOT make any conclusions.” Wizardsardine’s technical autopsy describes multiple failed safeguards and says the failure sat “across a submodule boundary, which is precisely where reviewers stop looking.” Steven Geller’s technical deep dive did not make a strong claim either way. DK27ss’s proof-of-concept reconstruction described the issue as “a chain of four flaws, each harmless in appearance.”

If the drains had been a classic insider retirement attack or a long con, the conversation today would likely look very different. The last major long-con hack in the Bitcoin industry was probably QuadrigaCX, the Canadian exchange whose founder, Gerald Cotten, was reported “dead in India” in 2018 under mysterious circumstances, not long after the missing funds were discovered. The Ontario Securities Commission accused the founders of misappropriating nearly 170 million CAD in customer deposits over many years before disappearing.

By contrast, Coinkite’s leadership remains publicly active. The company has responded to the incident, shipped patched firmware, helped users migrate, and engaged on the technical details. Its founders and operators are still operating the business and did not disappear when the funds went missing.

Meanwhile, the Wave 1 funds — more than 1,000 BTC — remain collected in three addresses, watched by hundreds of engineers and likely law enforcement, including the FBI. If Coinkite were carrying out a “5D chess” retirement attack, it would have been far more careful with the stolen coins. It would not have pooled them into a handful of highly trackable addresses, and its founders would likely not be around to discuss the incident.

Several open questions now frame what comes next: whether the Wave 1 coins move out of the three watched addresses; whether Gray or Coinkite publicly address the GPG-signature findings, which they had not done as of this writing; and whether owners of the still-vulnerable seeds generated between 2021 and the July 2026 patch migrate their funds before later-wave opportunists reach them.

No final conclusions are available yet, and investigations will likely continue for years. For now, the evidence points to a cultural failure in the Bitcoin maximalist and self-custody community, a lack of broad education around good open-source hygiene, and, in hindsight, overconfidence on the part of Coinkite’s early leadership.

This article first appeared on Bitcoin Magazine and is written by Juan Galt.