#780: Dissecting The Coinkite Hack with Alex Thorn

August 5, 2026

AI Summary

5 min read

In late July 2024, a vulnerability in Coinkite’s Coldcard hardware wallet was exploited, draining Bitcoin from users who had done everything right. They had not leaked a seed phrase, clicked a phishing link, or used a sketchy service. They had simply trusted a device designed for maximum security. Within days, Galaxy Research’s Alex Thorn had traced over 1,500 Bitcoin across multiple attack waves, and the Bitcoin community was scrambling to understand how the exploit worked, who was behind it, and what it meant for the future of self-custody.

The Vulnerability and the First Wave

The exploit targeted Coldcard firmware versions 4.0.0 and later, released in March 2021. These versions contained a bug in the random number generator used to create private keys. Instead of generating truly unpredictable keys, the flawed firmware produced keys with insufficient entropy, making them vulnerable to brute-force attacks. An attacker—likely using AI to identify the weakness—could generate the same private keys as legitimate Coldcard users and simply sweep the funds.

Continue reading the full summary in the app — free to try.

Read Full Summary →

Free • No credit card required

Listen to Audio Summary Open in App

Never miss an episode of TFTC: A Bitcoin Podcast

Get every new episode summarized in your inbox — free, ~5 minutes to read.

No spam. Unsubscribe anytime.

What you'll learn

1 (00:07) **Episode Introduction** - Marty Bent sets up the conversation about the Coinkite/Cold Card hack and introduces Alex Thorn from Galaxy Research.
2 (01:44) **The Victim Call to Action** - Alex explains how victims can help by sharing drained addresses and transaction IDs.
3 (03:45) **The Nature of the Attack: AI and Wave Patterns** - Alex reveals that AI was likely used to identify and exploit the Cold Card vulnerability.
4 (06:54) **Anatomy of Wave One** - Alex breaks down the topology of the first wave of the attack.
5 (10:26) **Wave Three: A More Sophisticated Pattern** - Alex describes a fundamentally different, more sophisticated attack pattern in wave three.
6 (13:07) **Connecting the Waves and Identifying Victims** - Evidence suggests waves one and two are the same attacker, and all victims share a common profile.
7 (15:09) **The Full Scale of the Attack** - Alex reveals the total scope, including unconfirmed footprints.

+ Full timestamped outline available in the app

Guests on this episode

Alex Thorn

Show Notes

Alex Thorn joins Marty to break down the Coldcard vulnerability draining Bitcoin wallets across multiple attack waves. Galaxy Research traces stolen on-chain funds while victims race against time to secure self-custodied BTC. They dissect AI-driven exploit patterns, white hat ethical dilemmas, casino exfiltration attempts, and why multisig collaborative custody is now essential infrastructure. Bitcoin security, private key entropy, and monetary sovereignty hang in the balance as attackers leverage frontier models against antiquated hardware. If you hold Bitcoin in cold storage, this conversation covers exactly what moves to make before your keys become the next target.

Alex on X: https://x.com/intangiblecoins

Galaxy: https://linktr.ee/galaxyhq

Find the Home Mining Playbook here: https://www.tftc.io/home-mining-energy-playbook

STACK SATS hat: https://tftcmerch.io/

Our newsletter: https://www.tftc.io/bitcoin-brief/

TFTC Elite (Ad-free & Discord): https://www.tftc.io/#/portal/signup/

Discord: https://discord.gg/yHGkvYxdqT

Opportunity Cost Extension: https://www.opportunitycost.app/

Shoutout to our sponsors:

Block:

Cash App: For a limited time, new customers can get $21 added to their balance. Just use code TFTC10 when you sign up, and send at least $5 to a friend in the first two weeks. Terms apply. Bitcoin services by Block, Inc. See the Bitcoin disclosures at cash.app/legal/podcast.
Square: Visit http://square.com/go/tftc for up to $200 off eligible Square hardware.
Bitkey: Use code TFTC10 for 10% off the new Bitkey.

Aven

https://www.aven.com/bitcoin

CrowdHealth

https://www.joincrowdhealth.com/tftc

Unchained

https://unchained.com/tftc/

Salt of the Earth:

https://drinksote.com/tftc

Join the TFTC Movement:

Main YT Channel

https://www.youtube.com/c/TFTC21/videos

Clips YT Channel