$91M Bitcoin Social Engineering Theft — Hardware Wallet Impersonation (August 2026)
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·FSN6wR…TV2nSummary
On August 19, 2025, a single victim lost 783 BTC (approximately $91 million at the time) after attackers impersonated customer support representatives for both a hardware wallet manufacturer and a cryptocurrency exchange. The stolen funds were routed through Wasabi Wallet's CoinJoin mixing service to obstruct traceability. Blockchain investigator ZachXBT publicly disclosed the theft on August 21, 2025, noting it occurred exactly one year after the $243 million Genesis creditor social engineering theft of August 19, 2024. This incident and its successor threats constitute a documented category-level attack pattern targeting high-net-worth Bitcoin holders through trusted-service impersonation, particularly dangerous in the August 2026 environment following the Coldcard firmware exploit and associated phishing surge.
Connected Entities
13 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- Monero→mentioned with→Bitcoin(60%)
- Monero→mentioned with→ZachXBT(65%)
- Litecoin→mentioned with→Bitcoin(70%)
- ZachXBT→mentioned with→Ethereum(70%)
- Litecoin→mentioned with→Monero(65%)
- ZachXBT→mentioned with→Malone Lam(80%)
- Litecoin→mentioned with→ZachXBT(70%)
- ZachXBT→mentioned with→Bitcoin(65%)
- $91M Bitcoin Social Engineering Theft — Hardware Wallet Impersonation (August 2026)→mentioned with→Litecoin(70%)
- + 41 more
Connected Through
12 shared actors · 618 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ethereumorganization
- □ZachXBTorganization
- ♦Bitcointoken
- □Moneroorganization
Timeline(8 events)
19 August 2024
A single Genesis bankruptcy creditor loses approximately 4,064 BTC (~$243 million) in a social engineering attack. Perpetrators impersonate Google support and Gemini exchange support, then use AnyDesk screen-share to steal private keys.
The Block / CoinDesk18 September 2024
Malone Lam and Jeandiel Serrano are arrested in Miami and Los Angeles respectively in connection with the $243M Genesis creditor theft, charged with conspiring to steal and launder cryptocurrency.
CoinDesk19 August 2025
A single victim loses 783 BTC (~$91 million) after attackers impersonate customer support representatives for a hardware wallet manufacturer and a cryptocurrency exchange. The theft occurs exactly one year after the $243M Genesis creditor attack. Funds are moved immediately to a Bitcoin address beginning bc1qyxyk4qgyrkx4rjwsuevug04wahdk6uf95mqlej.
ZachXBT via Telegram / Decrypt / CoinDesk21 August 2025
ZachXBT publicly discloses the $91M theft via his Telegram investigations channel, noting the anniversary timing and the use of Wasabi Wallet for laundering. He advises: 'Assume that every call or email received is a scam by default.'
ZachXBT Telegram / CoinDesk / Decrypt10 January 2026
A victim loses $282 million in BTC and Litecoin in a hardware wallet social engineering scam. Attacker converts stolen assets to Monero via multiple instant exchanges, causing XMR price to surge ~70% over four days. ZachXBT confirms North Korean involvement is not suspected.
CoinDesk / ZachXBT on X30 July 2026
Coldcard firmware exploit discovered: a 2021 build configuration error reduces private key entropy to ~40 bits on older devices. Wave 1 drains approximately 1,083 BTC (~$70 million) from over 500 addresses in 41 minutes. At least 15 independent attackers eventually exploit the flaw.
Fortune / TRM Labs / TechCrunch3 August 2026
Proofpoint documents a coordinated phishing campaign impersonating Coldcard, inviting users to complete a 'coordinated hardware audit.' The cloned site deploys ScreenConnect remote access software; a human operator staffs fake support chat to assist victims in installing it.
Decrypt / Crypto Economy4 August 2026
Total Coldcard exploit losses reach approximately $116–130 million across 5,200+ addresses. Trezor and Foundation issue warnings about phishing surges targeting hardware wallet users.
TechCrunch / DecryptDecision Log
- slot 457749337 · hash 5SeXqVFJhGct7BC7eub9RdZYATrnyezqgmBoZcHU68uB
- slot 457741760 · hash 4GbrqPBcj7yPYMWX8Y1GmhkhDaG6fUTi6jBYaPL9QuUt
- slot 443506412 · hash H4Skz7owgcbJm2T92FicBZZ4KJ2D6pi3ucpN3URHbtBG
- slot 443506398 · hash 5vL1A8MRDMWgkztVB17oPv1RGf3xRRBq6DxpYwwenMK4
- slot 443506027 · hash 2mNWHPSHVHeF6EaR8GHD7mH2snmLYtJPxvAJ9cnj5Kqt
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 21 of 23 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/8/2026, 12:16:30 PM
last updated: 8/8/2026, 12:16:30 PM
6 viewsavoid.net — verified advice for a post-truth world