Coldcard Attack Investigation Faces AI Predicament, Galaxy Research Head Says Had to Turn to Chinese Open-Source Models to Track Stolen Funds
TechFlow news, August 2, Galaxy Research Director of Research Alex Thorn stated in a post that attacks targeting addresses generated by Coldcard wallets are ongoing, currently continuing to collect victim information, and adding new victim addresses and attacker addresses to the investigation database. If users are still using affected Coldcard single-signature addresses, they should immediately move funds. According to current investigation results, all single-signature Coldcard addresses generated after the March 2021 firmware upgrade may eventually be drained by attackers; it is only a matter of time. According to Galaxy Research's analysis, the currently confirmed first three rounds of attacks exhibit highly programmatic characteristics, with similar attack transaction patterns. A large amount of stolen Bitcoin remains in attacker addresses and has not yet been transferred. However, at the same time, some new opportunistic attackers are emerging, transferring and laundering funds through peeling chains, cross-chain services (such as ThorChain), and overseas gambling platforms.
Additionally, Alex Thorn also mentioned limitations of AI tools in security investigations. Some US large language models limit researchers' ability to track stolen funds, and the team even had to turn to Chinese open-source AI models to assist in protecting user assets and conducting on-chain tracking. He considered this phenomenon "unbelievable" and plans to promote discussions on relevant issues at the government and industry levels. Alex Thorn finally stated that currently a large amount of stolen funds remains stationary, the team is continuously tracking relevant addresses, and has shared information with relevant US agencies and industry partners. He called on the Bitcoin community to learn lessons from this incident, strengthen self-custody security education, and increase awareness of wallet complexity.
