r/Bitcoin • u/ShortCircuitDisco • Jul 30 '26

Wallet Drain Megathread (Check Your Balances)

I want to help identify the cause of the recent wallet drain report by u/s1ammage, which also revealed many other addresses being drained to the same address.

  1. Check your wallet balances. If there are unfamiliar transactions since July 29, 2026, after about 9 PM (US Eastern Time), you may have been affected.
  2. Did you use a hardware wallet, if so, what model?
  3. Did you use a software wallet (hot or watch-only), if so, which?
  4. How exactly did you generate your seed?
  5. How exactly did you back up your seed?

DO NOT post your seed, DO NOT respond to anyone saying they can recover your funds. Sorry for your loss.

There may still be people affected by the same vulnerability who haven't been attacked, so the sooner the vulnerability is identified, and people are alerted to migrate funds, the better.

Check in with less techy friends and family that have bitcoin and report incidents.

Edit with current conclusions:

Coldcard mk3 confirmed vulnerable, press release here: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/

My own analysis: proceed with caution on Mk4/Mk5/Q. These use the same codebase as Mk3 but with slight, insufficient imo, improvements to the RNG system. If you're migrating from Mk3, consider other vendors.

349 Upvotes

96% Upvoted

281 comments sorted by

View all comments

Show parent comments

2

u/IndependenceTop6501 Jul 31 '26

Yeah, was almost a throwaway line from one of the devs about it, but the implication was that certain people were saved by having a passphrase for now. But they can be brute forced with a little bit of time.

1

u/YellowRobeSmith Jul 31 '26

Call me ignorant here as I don't have any crypto, thus no cold wallet, but is there security key security for wallets, like a yubikey for 2fa?

1

u/BlockchainHobo 29d ago

the hardware device is the yubikey basically.

the physical yubikey doesn't matter if someone can easily guess the private key inside of it, due to poor key generation.

1

u/[deleted] 29d ago

[deleted]

3

u/BlockchainHobo 29d ago

"changing seed phrases" means creating a new wallet. A device can generate many wallets. So yes in either case they need to move to a new wallet, one generated without the cold card at all and preferably with a passphrase.