Investigators have traced the first wave of the July 2026 Coldcard hardware wallet exploit to a paid data account, and the FBI may have identified the attacker behind the theft of 1,082 Bitcoin worth approximately $69 million, according to new details emerging from the ongoing investigation.
The development represents a significant breakthrough in the investigation of what has become the largest hardware wallet exploit of 2026, in which attackers drained roughly 1,816 BTC valued at approximately $116 million from over 5,200 addresses across four waves starting July 30. The first wave alone saw 1,082 BTC stolen from 1,196 Coldcard wallets.
How the Investigation Unfolded
Blockchain researchers traced the first wave of thefts to a paid data account, which provided a lead that the FBI has reportedly used to narrow down the identity of the attacker. The FBI has not confirmed identifying or charging anyone, and the investigation remains ongoing. The use of a paid data account suggests the attacker may have purchased wallet data or vulnerability information through underground markets, creating a financial trail that investigators could follow.
The investigation has been complicated by the nature of the exploit. Attackers targeted Coldcard hardware wallets that had generated seed phrases using a vulnerable random number generator, allowing them to predict the private keys for affected wallets. Unlike exchange hacks where stolen funds pass through known addresses, hardware wallet thefts can be harder to trace because the attackers can move funds through multiple wallets and mixing services before cashing out.
The Scale of the Coldcard Exploit
The July 2026 Coldcard exploit was unprecedented in the history of hardware wallet security. Attackers exploited a vulnerability in the wallet's firmware that affected the randomness of seed phrase generation, allowing them to regenerate private keys for wallets that had been initialized during a specific period. The exploit affected wallets across four waves, draining approximately 1,816 BTC from over 5,200 addresses.
The first wave, targeting 1,082 BTC from 1,196 wallets, was the largest single wave of the attack. The attackers systematically drained wallets by generating the same private keys that the affected wallets had produced, allowing them to sign transactions and move funds without physical access to the devices. For more on the original Coldcard vulnerability, see our coverage of the Coldcard bug that went unnoticed for years.
What This Means for Hardware Wallet Security
The potential identification of the attacker could provide valuable insights into how hardware wallet exploits are carried out and how attackers access the information needed to target specific devices. If the FBI confirms the identity and makes an arrest, it would represent one of the few cases where a hardware wallet thief has been identified and prosecuted.
The investigation also highlights the importance of secure random number generation in hardware wallets. The vulnerability that enabled the exploit was in the wallet's entropy source, the component responsible for generating unpredictable random numbers used to create private keys. When the entropy source is compromised or predictable, attackers can reproduce the same keys and gain access to the affected wallets.
The Broader Context of Crypto Theft Investigations
The Coldcard investigation is part of a broader landscape of cryptocurrency theft investigations. In 2025, North Korean-linked actors stole approximately $2.02 billion in cryptocurrency, with the Bybit hack representing the majority. Law enforcement agencies have been increasing their focus on cryptocurrency crime, with the FBI and other agencies developing specialized teams for blockchain analysis and crypto asset recovery.
However, the success rate of crypto theft investigations remains low, particularly for cases involving self-custody wallets where attackers can operate with a degree of anonymity not available on regulated exchanges. The Coldcard case could set a precedent for how hardware wallet exploits are investigated and prosecuted. For more on crypto security, read our coverage of Bybit's security overhaul.
For the latest crypto security news, visit Bitnxt.
