Bitcoiner since 2013 who lost it all in the cold card hack. Rebuilding sat by sat with more conviction and grit - I will NEVER ask for donations or sympathy.
Joined August 2026
- Tweets34
- Following5.9K
- Followers3.7K
- Likes684
Pinned Tweet
Cold Card Hack Update - One Month Later…
Hello again,
I just wanted to share a few thoughts for those that are interested, but in particular for the other victims. While I can’t offer you brevity with this post - in an age of AI slop, fakeness and grift, I hope you can appreciate something very real.
First of all, I am genuinely happy for all of you who are now enjoying what appears to be the end of this cycle’s bear market. You all deserve this for your conviction, and even though many of us are forced to sit this one out for now, I am still cheering you on from the sidelines.
Don't feel bad about celebrating - just try to remain humble as your entire life can change in an instant in so many unpredictable ways.
NEVER take for granted the freedom and security that your bitcoin will provide to you now, and in the future. Ultimately, the bitcoin journey will teach you life’s not about the money anyways so be a good person and take care of those around you.
Safeguard your bitcoin appropriately, keep learning, never let your guard down even for a moment, and don’t make my mistake of becoming complacent and trusting others with something so critical.
It should be obvious by now that the scammers will become more relentless, the capabilities of the black hats will increase dramatically, and the number of real world physical attacks will rise - everyone wants your bitcoin!
To the other cold card victims:
It has given me a great sense of solidarity connecting with many of you, hearing your stories and reading messages of support.
It should be very clear by now that no one is coming to save us. Not your favourite influencers, not other OGs, not the bitcoin billionaires, no personal/corporate/government bailouts, and as it seems: certainly not NVK and Coinkite. We must save ourselves, and bitcoin remains hope.
Our only, albeit unlikely, path to recovery is now ironically in the hands of the state (law enforcement) and chain analysis firms, which as bitcoiners we can only find some humour in.
Now, I want to make a promise to you all: should the Wave 1 hacker get caught, and all the stolen funds be returned to victims - I pledge 20 BTC of my returned coins to be split between the people who directly helped find and bring the attacker to justice, and also the victims of the later waves who were unable to get their funds back. I have great empathy for you all, who did everything you were told was correct. We are all in this together, and I believe it’s the moral thing to do. Let this gesture be a reminder to the larpers in this space, that honourable bitcoiners do exist, and this journey we are all on together isn’t just about watching your own portfolio grow. Over the coming years as the price of bitcoin continues to rise, so too does the USD value of this pledge.
And if there is no recovery: as the days turn to months and years while people move on - we can take solace in the fact that our sacrifice will help hundreds of millions of people in the future on their bitcoin journey towards SAFE self-custody. Contrary to some of the narratives floating around: self-custody and “bitcoin maximalism” are NOT dead. Never forget that holding your own keys is one of the cornerstones of bitcoin, a right and great responsibility to uphold, always be wary of those who tell you otherwise.
As I’ve told some of you privately, our energy is best spent focusing on what we can control: ourselves, accepting this lesson, and building back stronger for us and our families. We will all survive this while we, dare I say, *acknowledge* how much of a catastrophic and monumental fuckup this was on Coinkite’s part. This story is far from over, and we all deserve the full truth, accountability, and justice.
On that front however, it's looking less likely that any meaningful lawsuits against them will materialize, simply because all the lawyers want money upfront which many of us don’t have now. Due to the nature of the situation it’s unlikely to resolve positively for anyone but the lawyers themselves. For that reason and others I, and several of the other large loss victims I’ve spoken with are likely to bow out. Don’t mistake this as a psyop, or a coordinated submission among us: it’s just the reality and realization we’ve come to independently.
However, that doesn’t mean they are off the hook—the hacker(s) and the Coinkite team have to live with their decisions and conduct for the rest of their lives. With no signs thus far to even attempt to set this right - as each day passes, their respective roads to redemption (while still open) start to close. This is true whether bound by lawyers or not, as even the slightest show of goodwill is better than silence. Karma is indeed real - even if it doesn’t manifest immediately.
Never forget that this disaster had nothing to do with bitcoin itself - it was the failure of one specific company, and exposed many unfortunate truths about our own shortcomings, the industry and its influencers.
Though as true bitcoiners, our spirit remains unbreakable. We are anti-fragile, stay resilient and even in the wake of such injustice and adversity we maintain our integrity and dignity. Though our plans may have been derailed for years or even decades - when we build back this time no one will be able to say we simply got lucky!
The fight for freedom money and self-sovereignty was never going to be easy, but the mission and need for bitcoin is clearer than ever: fiat is dying.
This will be my last post until this situation is resolved. I’ve yet to stack any sats since the incident and need to focus on my own path forward in life. I remain open to all opportunities that help me get back on my feet again.
Eventually the sun will rise for us all.
Cheers to building back, and until then: tick tock, next block.
-M
A class action lawsuit has been filed against Coinkite.
courts.ontario.ca/portal/cou…
Atlas Phoenix BTC retweeted
Vile scum. Zero humility.
Has @COLDCARDwallet , @Coinkite, @nvk, anyone paid back anything to any victim? Or are you all still going about your life with no remorse?
“Problems happen”
Why don’t you set up a fundraiser?
why not give future profits to the victims?
why not have some fucking honour and do something? Anything other than retweet bullshit to try and make yourselves feel less guilty, to justify your insane crookedness (or at absolute best, insane incompetence).
You financially ruin people but you think all is forgiven because “problems happen”.
You have two choices left.
Cowardice: hide behind "problems happen," retweet others’ failures (which are completely irrelevant to your own), protect your own wealth, and be remembered forever as the people who ruined lives and shrugged.
Or honour: stand up, own it completely, take the hit. Put everything you have toward making victims whole. Commit future profits. Accept it'll cost you massively, because it should.
The second road is harder and it will hurt like hell. Just like for those who lost their entire life savings. It's also the only one where anyone could even possibly begin to respect you again.
Respect isn't restored with PR or by pointing at other people's disasters. It starts the day you step in front of the bullet for the people who you’ve wronged.
Choose.
Atlas Phoenix BTC retweeted
Full post-mortem of the September 19 attack, and a 50% bounty — up to 3.3 BTC — on the stolen funds:
blink.sv/blog/sept-19-attack…
Bounty terms:
blink.sv/bounty-terms
On Saturday September 19 an attacker used a flaw in our admin tools to take over 35 Blink accounts and withdraw about 6.61 BTC from 24 of them. A customer called one of our engineers at 11:39 UTC. Fifteen minutes later the whole custodial service was off. By that evening the hole was closed and the service was back. By Thursday September 24 every affected customer had their exact balance back, in bitcoin and in dollars, paid for by Blink's shareholders. No customer bears any loss.
This was our fault. Not Bitcoin's, not our users'. To the 22 customers whose bitcoin was taken, and to the 3,817 people whose account details were looked up: we are sorry.
How it happened:
From October 2023 until that Saturday, anyone with a free Blink account and a web browser could give themselves the powers of our support staff: change the email or phone on any account, log in as that customer, raise their limits. Three unremarkable mistakes in how our admin tools checked permissions, stacked on top of each other, in code we inherited.
The whole team was busy moving tens of thousands of users to self-custody under new regulation. Monitoring built to catch outages didn't catch an administrator doing things no administrator should.
What it didn't touch:
The money came out of our hot wallet. Most customer funds sit in multi-signature cold storage that nothing in our admin tools can reach. Non-custodial accounts were never in play: we don't hold those keys.
What the attacker saw:
They also read the details of 3,817 other accounts, in some cases a phone number or email address. Not names, not IDs, not addresses, not passwords, not seed phrases. We wrote to every holder we could reach, saying exactly what was seen.
What stopped them:
Two-factor authentication. The attacker logged in to nine accounts that had it on and tried eighteen times to move money. Zero loss.
None of the 24 drained accounts had it on. If you take one thing from this post: Settings → Security and Privacy → Two-factor authentication. Then turn it on for your email too.
What we changed:
The flaw was fixed the same day and a third layer added two days later. The admin tools are off the public internet. The functions that change a customer's email or phone are switched off for everyone while we redesign them. All customer API keys were revoked.
The hot wallet now holds a fraction of what it did. Security fixes are developed privately and published once deployed; the code stays open source. A standing security reporting channel is live, with rewards of up to 0.1 BTC for critical findings.
Where the money is:
Some still sits where it was withdrawn to. About 5 BTC has gone through a cross-chain swap service; a small amount reached an exchange that is cooperating.
Criminal complaints are filed in El Salvador and Próspera, the regulators are notified, and we have traced the funds continuously. We are not expecting the money back.
So we are putting a 50% bounty on it.
Whoever provides the information that leads to a recovery gets 25% of what is recovered. Another 25% of anything recovered goes to Bitcoin Beach, Bitcoin Ekasi, Afribit Kibera and the circular economies they choose. No cap, no end date, paid only out of funds that actually come back. Write to [email protected].
We would far rather have spent this money on grassroots Bitcoin adoption than lost it to a thief. Shame on the attacker.
One more thing:
Ignore any email or SMS about this incident that contains a link: we contacted affected users only through messages in the Blink app. We will never ask for your PIN, password, seed phrase or a login code.
The full post-mortem has the timeline, the technical detail for anyone running code derived from ours, and the bounty terms (links at the top).
Atlas Phoenix BTC retweeted
To whoever drained the COLDCARD funds,
You may be celebrating. You discovered a vulnerability, executed the exploit, and walked away with over 1,500 BTC.
But what you actually acquired isn't just bitcoin. You acquired one of the most heavily monitored UTXO sets on the planet.
Every forensic blockchain company has already tagged those outputs.
Every exchange, institutional custodian, compliance provider, and investigator will be watching where those coins move. CoinJoin, cross-chain bridges, mixers, peel chains, OTC desks, privacy tools... none of them magically erase history. Blockchain analysis in 2026 is far more sophisticated than many people realize.
What many hackers fail to appreciate is that Bitcoin has no statute of limitations. Every transaction you make from this moment forward becomes part of a permanent public record. Twenty years from now, the blockchain will still contain the complete history of every satoshi you moved. The data isn't going anywhere.
Forensic tools won't stand still either. Machine learning models, address clustering techniques, exchange intelligence, leaked databases, KYC records, seized servers, surveillance footage, IP logs, phone metadata, travel records, and future analytical methods that don't even exist today can all be combined retrospectively.
Investigators don't need to solve the puzzle today. They can revisit the exact same blockchain years from now with better technology and new intelligence, following your historical transactions as if they happened yesterday.**
As someone who lost bitcoin during the Mt. Gox collapse, I know what it's like to watch your coins disappear. It took years of uncertainty before I recovered anything.
You also have absolutely no idea whose money you've taken. It isn't just individuals and companies. Some victims may have extensive resources, influential connections, or backgrounds you know nothing about. Among hundreds of affected people could be former intelligence officers, wealthy financiers, organized crime figures, or people with both the means and the determination to pursue this indefinitely. You simply don't know whose interests you've just collided with.
Many victims have similar stories. Some may shrug it off. Others may dedicate years, or far more, to identifying those responsible. You simply don't know who is behind those wallets or how determined they may be.
If you think the challenge is over because the exploit succeeded, you've mistaken the easiest part for the hardest. Stealing the bitcoin was the beginning.
Living with it is the real problem. Every attempt to cash out, every wallet you touch, every service you use, every mistake you make, increases the probability of connecting your online identity to your real one.
If I were in your position, I would seriously consider approaching CoinKite and negotiating the return of the funds in exchange for a reasonable bounty or audit fee. You proved your technical ability.
That's far better than spending the rest of your life trying to move one of the most notorious collections of tainted bitcoin ever created while constantly wondering who is watching your next transaction
Atlas Phoenix BTC retweeted
COLDCARD SEED-ENTROPY THEFTS
a short video
1,830 BTC taken
3 waves, more than 30 smaller footprints
256 victims have come forward to @glxyresearch
median loss 1.1 BTC
but the hunt for the attackers continues..
Atlas Phoenix BTC retweeted
❄️COLDCARD WHITE HAT MOVES FUNDS TO TRUST 🏳️
52.37 BTC comprised of coins from Wave 2, Footprints AA, AU, AX consolidated into a fresh address with an OP_RETURN "claim:cryptorecoverytrust dot com" in block 967,948
these white hatted funds represent 2.8% of the coldcard exploit
opensats.org/funds/red
Together, we grow stronger!
DMs open especially for the other victims who need someone to talk to - let's get through this together!
Re: Cold Card Hack
Hello fellow Bitcoiners,
It’s been nearly one week since my wallet was drained.
I lost my entire bitcoin stack, presumably the most in the entire attack - an amount I’m more than embarrassed and ashamed to even admit publicly. This was not only my life savings but my time, energy, hardcore conviction and identity after 13 years in this space.
I am posting pseudonymously as I’ve always preferred to stay out of the spotlight - and privacy (inspired by Satoshi) is something I value. I debated whether or not I should say anything at all, but after much deliberation I decided it may be beneficial for other victims who are struggling.
While this incident certainly forced upon me the darkest days of my life so far - I have now accepted it and will slowly put together my life again. I came from nothing and did everything right (except rolling the damn dice apparently 😅). I stayed away from trading, exchanges, shitcoins, ICOs, NFTs, false prophets, etc and quietly and consistently built up over the years through all the ups and downs - never spending frivolously on material goods but instead using bitcoin as my sense of freedom and security - with the hopes to pass it on to my future children.
Even though that peace, freedom and security is now gone - I am beyond grateful for the journey and life that bitcoin enabled me to have.
To all the other victims, as cliche as it is to say “it’s only money” - true wealth, as I’ve learned over and over again is in health, family, and friendships. I’d be lying if I told you I’m not afraid of the uncertainty ahead, but I know by taking one step at a time it will be possible to rebuild. Trust me if I can come to these realizations, you can too! The hardest challenges in life make us stronger and turn us into the best versions of ourselves - don’t give in to the hopelessness. By being in this community you are apart of something special that the majority of the world still hasn’t realized yet. It’s still early!
Thanks to all the wonderful people in the community I’ve been DMing over the past week - your kind words of support mean the world to me and helped me start to believe in myself again.
To the hacker: you still can do the right thing here and come clean - you have prompted a serious wake-up call that has brought the community together which will bring more resilience for the future. Doing the noble thing now will prevent a lifelong hunt.
To all the amazing bitcoiners who have jumped to action from the very beginning to support each other and mitigate further damage - it’s been a beautiful thing to watch.
To the @blocks team and especially @intangiblecoins, your efforts are inspiring and provide me with hope. Believe me when I say that IF I ever get my coins back you will all be taken care of very well, along with massive donations to the open source community.
For now I will withhold any judgement towards @nvk and the @Coinkite team - while I’m still processing this loss and dealing with the gravity of building my life up from the ruins - I have 0 anger or resentment. Bitcoin security is a tough job, mistakes are made, and lessons are learned by all. I made mistakes by trusting and not verifying as well as not having a more robust security solution so the responsibility must be shared, hindsight is 20/20 and even though it’s tough: I’m okay admitting that. Bitcoin humbles all.
Having said all that… I’M NOT FUCKING LEAVING!!! I will start building a new stack from the ground up like all the other plebs as my conviction in Bitcoin is even stronger today then when I got my first coins in 2013.
This was never about the money - it was always about the revolution, and that can’t be stopped. We will win.
Let’s keep our heads high.
The march continues.
It’s time to rebuild.
PS: Thanks for everything Satoshi ❤️
-M