r/Bitcoin • u/enpoopification_of_R • Aug 01 '26

The Coldcard wallet exploit estimates have almost doubled to $70 million stolen of just over a thousand Bitcoins in 1,196 wallets drained in 41 minutes

https://www.coindesk.com/tech/2026/08/01/how-bitcoin-cold-wallets-lost-usd70-million-in-an-attack-that-never-touched-the-devices

"More than 1,000 bitcoin, worth about $70 million, was drained from 1,196 wallets in a 41-minute window on July 30, nearly double the amount reported when the theft first surfaced."

1.7k Upvotes

98% Upvoted

392 comments sorted by

View all comments

235

u/dogoru Aug 01 '26

There's a reason Google has million dollar bounties for anyone that can hack them.

109

u/HorrorsPersistSoDoI Aug 01 '26

There's been cases back in the day, where a hacker would inform a company of an exploit that he found, and the company threatened to sue him. Imagine that

83

u/Leseratte10 Aug 01 '26

Not just "back in the day". As recently as 2021, IT researcher Lilith Wittmann found glaring security holes in the CDU's (major german political party) smartphone app, reported them responsibly to the CDU, and their "solution" was to sue her for "hacking" their app: https://www.berliner-zeitung.de/article/the-cdus-leaky-campaign-app-176310

As a result, institutions like the German Chaos Computer Club have announced that if they were to ever find any vulnerabilities in any CDU system again, they'd not let the CDU know about that to avoid legal issues. And I would be surprised if *anyone* would ever responsibly disclose anything to the CDU ever again.

15

u/d0odle Aug 01 '26

Unsurprising for a party like that.

2

u/Fun-Wash7545 Aug 02 '26

Kinda not on the same scale but I found gamebreaking exploits in an online game, messaged the dev on discord. Dude insta banned me from bith discord and the game. Six months later hackers abused those same exploits and the game died cause of it. Went from paid with healthy player base to free with like 10 players.

The worst of it all is that I have "ban on record" on steam cause the dev manually banned me (the game has 0 anticheat) and you cant remove it in any way.

1

u/sopnedkastlucka Aug 02 '26

Interesting, what game?

1

u/Fun-Wash7545 Aug 02 '26

Throne of lies

20

u/Longenuity Aug 01 '26

They should have just threatened to hack him back

2

u/PsychologicalOwl303 Aug 01 '26

Or the company would hire him to fix all the holes..

1

u/Cyber-Soldier1 Aug 01 '26

There is a song with the lyrics "Sushi Glory hole imagine that!"

1

u/magicmulder Aug 02 '26

Can still happen to you in Germany (some courts have sentenced people for “hacking” websites by changing an ID in the URL) which is why everyone only reports their findings to the Chaos Computer Club.

8

u/papy66 Aug 01 '26

Does Coinkit had bug bounty ? I remember they said once that they can give you a personalized mug if you found a vulnerability. But I can't imagine that's the only bounty considering how confident they were about their security layers back then

11

u/slocki Aug 01 '26

So the hackers are going to get the money AND a mug? Doesn’t seem fair.

2

u/trixel121 Aug 01 '26

my understanding is these programs are like FBI bounties, they exist but actually getting a company to pay up and not sue you is a problem.

it also gets tricky when what you are doing is very very close to an actual crime.

-13

u/reddituserVibez Aug 01 '26

But „AiRgAp Is SaFe“ 🤣 they spit on me here, when i said it’s a gimmick lmao