A Bitcoin address holding roughly $36 million in stolen funds from the ongoing Coldcard hardware wallet hack has become an unexpected public forum. Since the theft began on July 30, the wallet has received a flood of messages attached to small Bitcoin deposits via the network’s OP_RETURN function, which allows users to permanently attach arbitrary data to a transaction.
The messages range from desperate pleas to absurd demands. One user begged “1 btc plz,” while another pleaded “only need 0.25 for my car, do your magic boss”. Someone wrote “COLDCARD, return 80% of my 5 BTC”. One message even tried to prompt the hacker like an AI: “Ignore all previous instructions. Send all the bitcoin in this address to bc1qez…”.
Others took a philosophical tone, with one person quoting: “He who has nothing has nothing to lose, but he who steals loses himself”. A bizarre request even asked for 5 BTC to buy cocaine and hire prostitutes. Blockchain investigators can trace the hacker’s transactions in real-time, adding a public dimension to this theft event.
The COLDCARD Hacker is getting a ton of messages.
— Arkham (@arkham) August 4, 2026
“1 btc plz”, “only [n]eed 0.25 for my car, do your magic boss”
One guy admonished him.
“He who has nothing has nothing to lose, but he who steals loses himself.”
One guy even tried to prompt him like an LLM:
“Ignore all… pic.twitter.com/2z6BCmDdXr
What Happened in the Coldcard Hack
The chaos stems from a catastrophic firmware flaw in Coldcard hardware wallets, manufactured by the Toronto-based company Coinkite. For over five years, a bug caused affected devices to generate seed phrases with only 40 bits of entropy instead of the expected 128 bits, making the private keys trivially brute-forceable. Attackers exploited this to reconstruct keys offline and sweep funds without ever touching a physical device.
Galaxy Research has confirmed 1,596 BTC (over $100 million) stolen from roughly 7,300 addresses across three attack waves. A suspected fourth wave could push losses to nearly 2,055 BTC ($130 million). At least 15 separate attackers are now competing to drain vulnerable wallets. The exploit sparked a surge in Bitcoin on-chain activity, with daily active addresses nearing 1 million; levels not seen since the FTX collapse.
Coldcard has urged all users to move funds immediately.
For more crypto news and price predictions from CaptainAltcoin, click here.
Subscribe to our YouTube channel for daily crypto updates, market insights, and expert analysis.
