ZachXBT announced he won’t track the $88.6 million Coldcard hack, pointing to a lack of support from Bitcoin enthusiasts. The blockchain sleuth, known for exposing major crypto heists, said his efforts go where they’re appreciated, and Bitcoin’s community hasn’t been backing him.
The Coldcard breach has drained over 1,300 BTC since July 30, 2026. The stolen coins, worth nearly $89 million, have flowed from thousands of addresses linked to the attack. Despite patched firmware released quickly by Coinkite, the theft has continued to grow.
The vulnerability came from a firmware issue in Coldcard Mk3 wallets, made by Canadian company Coinkite. A software flaw caused some wallets to rely on weaker seed generation methods, making certain keys guessable. The first wave took almost $38 million from dormant wallets within half an hour.
Researchers at Galaxy Research have been tracking the stolen funds, but with little help from the wider Bitcoin community, investigative efforts are slowing. The speed of the thefts and the rising number of affected addresses suggest an automated tool, possibly AI-based, is identifying and emptying vulnerable wallets rapidly.
ZachXBT’s withdrawal reflects growing frustration with Bitcoin maximalists, who rarely support security investigators despite benefiting from their work. This contrasts with his past pro bono work on major cases, which drew appreciation from other crypto communities.
The incident adds to ongoing debates about hardware wallet security and response transparency. Meanwhile, stolen coins continue to be moved, increasing pressure on exchanges and regulators to act. The fallout also echoes recent security concerns seen in other high-stakes crypto thefts.
This article is for informational purposes only and not financial advice.
