FBI May Know Identity of Coldcard Wave 1 Bitcoin Hacker

Law enforcement may finally know the identity of the person who emptied more than a thousand Bitcoin from Coldcard wallets during the first major wave of the July 2026 attacks. Block investigators recently traced the attacker on chain sweeps to a paid account at a major blockchain data provider. Internal logs from the provider matched the theft pattern with incredible precision, giving authorities a solid lead.

More than 1,000 bitcoin from that initial wave are still sitting untouched in the attacker address. This gives victims real hope that a recovery might happen once authorities catch the thief. However, the total damage across multiple waves has climbed past 1,800 bitcoin, or roughly 118 million dollars, affecting thousands of addresses using older vulnerable firmware.

While the first wave suspect might be exposed soon, security experts note that later waves show different patterns. Other copycat actors likely jumped in after the vulnerability became public knowledge. Investigators are still working with authorities to track down all involved parties, while users with older devices must move their funds immediately.