Audit log

Every state-changing event for $91M Bitcoin Social Engineering Theft — Hardware Wallet Impersonation (August 2026): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-08 12:16:39Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   2mNWHPSHVHeF…9cnj5Kqtcopysha256 → base58

   verifying row…

   canonical bytes (29169 B) ▸

   {"actor":"system:backfill","investigation_id":"66c63ff3-4d66-4fac-81e6-e753ddf53383","kind":"publish","page_slug":"91m-bitcoin-social-engineering-theft-hardware-wallet-impersonation-august-2026","published_at":"2026-08-08T12:16:39.396Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"$91M Bitcoin Social Engineering Theft — Hardware Wallet Impersonation (August 2026)","sections":[{"content":"On August 19, 2025, a single individual lost 783 BTC — valued at approximately $91 million at the time of the theft — to a social engineering attack. Blockchain investigator ZachXBT disclosed the incident on August 21, 2025, via his Telegram investigations channel. According to ZachXBT's report, 'A victim recently lost 783 BTC (~$91M) in a social engineering scam. Funds have been moving around this week via Wasabi.' The victim was allegedly approached by individuals impersonating customer support representatives for both a hardware wallet manufacturer and a cryptocurrency exchange; neither entity has been publicly identified in available sources. The attacker manipulated the victim into disclosing sensitive credentials, which may have included seed phrases or private keys, and transferred the Bitcoin to attacker-controlled addresses.","heading":"Incident Overview","severity":"critical","sources":[{"credibility":2,"name":"Bitcoin Investor Loses $91 Million to Social Engineering Scam: ZachXBT — Decrypt","type":"news_article","url":"https://decrypt.co/336279/bitcoin-investor-loses-91-million-to-social-engineering-scam-zachxbt"},{"credibility":2,"name":"Victim Loses $91M in Bitcoin in Social Engineering Scam: ZachXBT — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2025/08/21/victim-loses-usd91m-in-bitcoin-after-social-engineering-scam-zachxbt"},{"credibility":2,"name":"ZachXBT Traces $91M Bitcoin Theft Through Wasabi Wallet and Mixers — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/zachxbt-traces-91m-bitcoin-theft-through-wasabi-wallet-and-mixers/"},{"credibility":3,"name":"Investor Loses 783 BTC in Crypto Scam, Funds Laundered via Wasabi — Yellow.com","type":"news_article","url":"https://yellow.com/news/investor-loses-783-btc-in-crypto-scam-funds-laundered-via-wasabi"}]},{"content":"The attack relied on a multi-layer social engineering approach — sometimes called vishing (voice phishing) — in which the perpetrators contacted the victim while impersonating support personnel for a hardware wallet manufacturer and a separate cryptocurrency exchange. No specific brand names for either impersonated entity have been publicly confirmed in available sources. The victim was reportedly induced into disclosing wallet credentials or seed phrases, or otherwise transferring control of funds under false pretenses. ZachXBT advised the public: 'Assume that every call or email received is a scam by default.' This tactic — impersonating legitimate support channels to extract private key material — requires no technical exploit of the wallet hardware or software itself; the vulnerability is entirely human. High-net-worth holders are disproportionately targeted because a single successful contact can yield eight-figure payoffs.","heading":"Attack Methodology: Support Impersonation","severity":"critical","sources":[{"credibility":2,"name":"Bitcoin Investor Loses $91 Million to Social Engineering Scam: ZachXBT — Decrypt","type":"news_article","url":"https://decrypt.co/336279/bitcoin-investor-loses-91-million-to-social-engineering-scam-zachxbt"},{"credibility":2,"name":"A Single Investor Lost $91M in Bitcoin to a Fake Support Scam — Finance Magnates","type":"news_article","url":"https://www.financemagnates.com/cryptocurrency/a-single-investor-lost-91m-in-bitcoin-to-a-fake-support-scam/"},{"credibility":3,"name":"$91 Million in Bitcoin Stolen in Sophisticated Social Engineering Scam — CoinCentral","type":"news_article","url":"https://coincentral.com/91-million-in-bitcoin-stolen-in-sophisticated-social-engineering-scam/"}]},{"content":"After the theft, the 783 BTC were transferred to a new Bitcoin address beginning with bc1qyxyk4qgyrkx4rjwsuevug04wahdk6uf95mqlej before being deposited into Wasabi Wallet, a privacy-focused Bitcoin wallet that implements the CoinJoin protocol. CoinJoin blends multiple users' transactions into a single transaction, breaking the on-chain link between inputs and outputs and complicating blockchain forensics. Following Wasabi mixing, the funds were dispersed across multiple additional wallet addresses. ZachXBT noted that funds had been 'moving around this week via Wasabi' at the time of disclosure. The theft transaction hash reported in secondary sources is da598f2a941ee3c249a3c11e5e171e186a08900012f6aad26e6d11b8e8816457, though this should be independently verified on-chain. No law enforcement recovery has been publicly reported as of the time of this investigation.","heading":"Fund Laundering: Wasabi Wallet and CoinJoin","severity":"high","sources":[{"credibility":2,"name":"ZachXBT Traces $91M Bitcoin Theft Through Wasabi Wallet and Mixers — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/zachxbt-traces-91m-bitcoin-theft-through-wasabi-wallet-and-mixers/"},{"credibility":3,"name":"Investor Loses 783 BTC in Crypto Scam, Funds Laundered via Wasabi — Yellow.com","type":"news_article","url":"https://yellow.com/news/investor-loses-783-btc-in-crypto-scam-funds-laundered-via-wasabi"},{"credibility":2,"name":"ZachXBT Uncovers $91 Million Bitcoin Theft in Sophisticated Scam — BeinCrypto","type":"news_article","url":"https://beincrypto.com/crypto-social-engineering-scam/"}]},{"content":"ZachXBT noted that the $91M theft 'happened on the one year anniversary of the $243 million Genesis Creditor theft.' On August 19, 2024, a Genesis bankruptcy creditor lost approximately 4,064 BTC (then valued at approximately $230–243 million) in a social engineering attack executed by at least three individuals operating under the handles Greavys (Malone Lam, also reported as Malone Iam), Wiz (Veer Chetal), and Box (Jeandiel Serrano). The attackers impersonated Google support to gain initial access to the victim's personal accounts, then posed as Gemini exchange support to convince the victim to reset two-factor authentication and transfer funds. The victim was also persuaded to share their screen via AnyDesk remote desktop software, revealing Bitcoin private keys. Malone Lam (Miami) and Jeandiel Serrano (Los Angeles) were arrested on September 18, 2024, and charged with conspiring to steal and launder cryptocurrency. The case is reported to be the first Bitcoin-related RICO prosecution in US history. More than $9 million in stolen funds were frozen, and approximately $500,000 was returned to the victim.","heading":"Precedent: The $243M Genesis Creditor Theft (August 19, 2024)","severity":"critical","sources":[{"credibility":2,"name":"Police Arrest Two People Related to $243M Crypto Heist Targeting Genesis Creditor — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2024/09/19/police-arrests-two-people-related-to-243m-crypto-heist-targeting-genesis-creditor"},{"credibility":2,"name":"ZachXBT helps secure arrests in $243 million social engineering attack — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/zachxbt-helps-secure-arrests-in-243m-social-engineering-attack-on-one-person/"},{"credibility":2,"name":"Blockchain sleuth ZachXBT alleges three attackers in $243M theft — The Block","type":"news_article","url":"https://www.theblock.co/post/317349/blockchain-sleuth-zachxbt-alleges-three-perps-involved-in-243-million-theft-of-single-genesis-creditor"},{"credibility":2,"name":"Massive $243 million crypto heist ends with multiple arrests and asset frozen — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/crypto-heist-arrests-millions/"},{"credibility":2,"name":"22-year-old sentenced to 70 months for money laundering tied to $263M crypto syndicate — The Block","type":"news_article","url":"https://www.theblock.co/post/398899/22-year-old-sentenced-to-70-months-for-money-laundering-tied-to-263-million-crypto-syndicate"}]},{"content":"On January 10, 2026, a further escalation in this attack pattern was documented by ZachXBT: a victim lost $282 million in BTC and Litecoin due to a hardware wallet social engineering scam. The attacker converted 2.05 million Litecoin and 1,459 BTC to Monero via multiple instant exchanges, causing Monero's price to surge approximately 70% over four days. Additional BTC was bridged to Ethereum, Ripple, and Litecoin via THORChain. ZachXBT stated that North Korean state-sponsored hackers were not involved, suggesting a non-state actor. CoinDesk reported this as 'the largest individual social engineering theft in cryptocurrency history' at the time of publication. No suspects have been publicly identified.","heading":"Escalation: $282M Hardware Wallet Theft (January 10, 2026)","severity":"critical","sources":[{"credibility":2,"name":"Hacker steals $282 million crypto from a victim in social-engineering attack — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/01/16/hacker-steals-usd282-milion-in-hardware-wallet-social-engineering-attack"},{"credibility":2,"name":"ZachXBT on X — January 10, 2026 hardware wallet theft disclosure","type":"social_media","url":"https://x.com/zachxbt/status/2012212936735912351"},{"credibility":3,"name":"ZachXBT Exposes Hardware Wallet Scam Breach of $282 Million Involving Monero — NullTX","type":"news_article","url":"https://nulltx.com/zachxbt-exposes-hardware-wallet-scam-breach-of-282-million-involving-monero/"}]},{"content":"The August 2026 threat environment for hardware wallet users was materially elevated by a separate, technically distinct incident: the Coldcard firmware exploit disclosed beginning July 30, 2026. A build configuration error introduced in Coldcard firmware version 4.0.1 (March 2021) caused seed generation to fall back on a software-based pseudorandom number generator rather than the device's hardware entropy source, reducing effective key strength to as little as 40 bits on older Mk3 devices. Attackers exploited this to brute-force private keys without physical access to victim wallets. At least 15 independent attackers were identified; total losses across four waves reached approximately 1,816–2,055 BTC ($116–130 million) from over 5,200 addresses. Coinkite confirmed the vulnerability and advised all users who generated seeds between March 2021 and the patch release to treat those seeds as compromised and migrate immediately. In the wake of the disclosure, hardware wallet manufacturers Trezor and Foundation warned of a surge in phishing campaigns. Security firm Proofpoint documented a coordinated campaign in which attackers sent emails impersonating Coldcard, inviting holders to complete a 'coordinated hardware audit'; the linked cloned website deployed a batch file that installed ScreenConnect remote access software, and a human operator staffed the fake support chat to guide victims through installation. This Coldcard-exploit panic context elevated the plausibility of all social engineering attacks impersonating hardware wallet support during August 2026.","heading":"Threat Environment: Coldcard Firmware Exploit (August 2026)","severity":"high","sources":[{"credibility":2,"name":"The Largest Hardware Wallet Exploit of 2026: Inside the $116M Coldcard Hack — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack"},{"credibility":1,"name":"Bitcoin owners rocked by $116 million hack: What we know about the Coldcard exploit — Fortune","type":"news_article","url":"https://fortune.com/2026/08/03/bitcoin-owners-116-million-hack-coldcard-coinkite-exploit/"},{"credibility":1,"name":"Hackers steal over $130M by exploiting bug in offline hardware wallets — TechCrunch","type":"news_article","url":"https://techcrunch.com/2026/08/04/hackers-steal-over-130-million-by-exploiting-bug-in-offline-hardware-wallets/"},{"credibility":2,"name":"Hardware Wallet Firms Warn of Phishing Surge as Coldcard Losses Near $130M — Decrypt","type":"news_article","url":"https://decrypt.co/374891/hardware-wallet-firms-warn-of-phishing-surge-as-coldcard-losses-near-130m"},{"credibility":1,"name":"Coldcard Security Audit Phishing Attack Installs Remote Access Tool — Bleeping Computer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/coldcard-security-audit-phishing-attack-installs-remote-access-tool/"},{"credibility":2,"name":"Hardware Wallet Providers Flag Dangerous Phishing Campaign — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/hardware-wallet-phishing-campaign-warning/"}]},{"content":"ZachXBT explicitly noted the coincidence of the $91M theft occurring on August 19, 2025 — the exact one-year anniversary of the $243M Genesis creditor theft on August 19, 2024. The deliberate timing, if not coincidental, may indicate that the same threat actors or affiliated networks are active on this date, possibly to create confusion with anniversary news coverage, to exploit users who are re-reading about prior incidents and are therefore primed to believe their own accounts may be at risk, or simply as a form of symbolic timing. No law enforcement or forensic source has publicly attributed the $91M theft to the same actors responsible for the $243M theft. The pattern of large single-victim hardware wallet social engineering thefts documented by ZachXBT — $243M (August 2024), $91M (August 2025), and $282M (January 2026) — represents a documented and escalating threat cluster targeting Bitcoin high-net-worth individuals through support impersonation. Collectively, these three documented incidents account for over $616 million in alleged social engineering losses from single victims.","heading":"Pattern Analysis: Recurring August 19 Attack Dates","severity":"high","sources":[{"credibility":2,"name":"Bitcoin Investor Loses $91 Million to Social Engineering Scam: ZachXBT — Decrypt","type":"news_article","url":"https://decrypt.co/336279/bitcoin-investor-loses-91-million-to-social-engineering-scam-zachxbt"},{"credibility":2,"name":"Victim Loses $91M in Bitcoin in Social Engineering Scam: ZachXBT — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2025/08/21/victim-loses-usd91m-in-bitcoin-after-social-engineering-scam-zachxbt"},{"credibility":2,"name":"ZachXBT Uncovers $91 Million Bitcoin Theft in Sophisticated Scam — BeinCrypto","type":"news_article","url":"https://beincrypto.com/crypto-social-engineering-scam/"}]},{"content":"ZachXBT issued direct public guidance: 'Assume that every call or email received is a scam by default.' Hardware wallet manufacturers Trezor and Foundation both issued warnings in August 2026 following the Coldcard firmware exploit disclosure, advising users never to enter recovery phrases except directly on the physical device, and stating that legitimate manufacturers will never request seed phrases or demand software installation. The Coldcard exploit advisory from Coinkite recommended that any user who generated a seed on a Coldcard device between March 2021 and the patch release treat that seed as compromised and move funds to a newly generated wallet. Users who receive unsolicited contact purporting to be from hardware wallet manufacturers or cryptocurrency exchanges should treat such contact as a potential attack regardless of the caller ID, email header, or website appearance. Legitimate support channels for hardware wallet manufacturers and exchanges do not initiate outbound support contacts requesting credential information.","heading":"Protective Guidance and Industry Response","severity":"medium","sources":[{"credibility":2,"name":"Hardware Wallet Firms Warn of Phishing Surge as Coldcard Losses Near $130M — Decrypt","type":"news_article","url":"https://decrypt.co/374891/hardware-wallet-firms-warn-of-phishing-surge-as-coldcard-losses-near-130m"},{"credibility":2,"name":"Hardware Wallet Makers Warn of Phishing After Coldcard Incident — ForkLog","type":"news_article","url":"https://forklog.com/en/hardware-wallet-makers-warn-of-phishing-after-coldcard-incident/"},{"credibility":2,"name":"ZachXBT Uncovers $91 Million Bitcoin Theft in Sophisticated Scam — BeinCrypto","type":"news_article","url":"https://beincrypto.com/crypto-social-engineering-scam/"}]},{"content":"The $243M Genesis creditor theft of August 2024 — the precedent incident ZachXBT linked to the $91M theft — resulted in documented arrests and an active federal prosecution. Malone Lam (age 20, Singaporean citizen, residing in Miami) and Jeandiel Serrano (age 21, Los Angeles) were arrested on September 18, 2024. Both were charged with conspiring to steal and launder cryptocurrency. A third suspect, Veer Chetal (handle: Wiz), was subsequently apprehended by US Marshals. The case has been characterized as the first Bitcoin-related RICO prosecution in US history. As of May 2026, Malone Lam's sentencing in the primary case had not concluded, with plea negotiations reported as ongoing through early 2026. A related co-conspirator received a 70-month sentence for money laundering. The Department of Justice USAO-DC has documented one sentencing of a California money launderer to 70 months in the broader $263 million scheme context. No arrests have been publicly reported in connection with the $91M August 2025 theft or the $282M January 2026 theft.","heading":"Legal Proceedings: $243M Theft Arrests and Prosecution","severity":"high","sources":[{"credibility":1,"name":"California Money Launderer Sentenced in D.C. to 70 Months for Role in Scheme that Stole $263 Million — US DOJ","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/california-money-launderer-sentenced-dc-70-months-role-scheme-stole-263-million"},{"credibility":2,"name":"22-year-old sentenced to 70 months for money laundering tied to $263M crypto syndicate — The Block","type":"news_article","url":"https://www.theblock.co/post/398899/22-year-old-sentenced-to-70-months-for-money-laundering-tied-to-263-million-crypto-syndicate"},{"credibility":2,"name":"Police Arrest Two People Related to $243M Crypto Heist Targeting Genesis Creditor — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2024/09/19/police-arrests-two-people-related-to-243m-crypto-heist-targeting-genesis-creditor"},{"credibility":2,"name":"ZachXBT helps secure arrests in $243 million social engineering attack — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/zachxbt-helps-secure-arrests-in-243m-social-engineering-attack-on-one-person/"},{"credibility":2,"name":"Crypto sleuth ZachXBT claims British threat actor tied to $243M Genesis creditor theft likely arrested — The Block","type":"news_article","url":"https://www.theblock.co/post/381481/crypto-sleuth-zachxbt-claims-british-threat-actor-tied-to-243-million-genesis-creditor-theft-likely-arrested"}]}],"sources_used":[{"credibility":2,"name":"Bitcoin Investor Loses $91 Million to Social Engineering Scam: ZachXBT — Decrypt","type":"news_article","url":"https://decrypt.co/336279/bitcoin-investor-loses-91-million-to-social-engineering-scam-zachxbt"},{"credibility":2,"name":"Victim Loses $91M in Bitcoin in Social Engineering Scam: ZachXBT — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2025/08/21/victim-loses-usd91m-in-bitcoin-after-social-engineering-scam-zachxbt"},{"credibility":2,"name":"Bitcoin Investor Loses $91 Million to Social Engineering Scam — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/news/bitcoin-investor-loses-91-million-215220517.html"},{"credibility":2,"name":"ZachXBT Traces $91M Bitcoin Theft Through Wasabi Wallet and Mixers — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/zachxbt-traces-91m-bitcoin-theft-through-wasabi-wallet-and-mixers/"},{"credibility":2,"name":"ZachXBT Uncovers $91 Million Bitcoin Theft in Sophisticated Scam — BeinCrypto","type":"news_article","url":"https://beincrypto.com/crypto-social-engineering-scam/"},{"credibility":2,"name":"A Single Investor Lost $91M in Bitcoin to a Fake Support Scam — Finance Magnates","type":"news_article","url":"https://www.financemagnates.com/cryptocurrency/a-single-investor-lost-91m-in-bitcoin-to-a-fake-support-scam/"},{"credibility":3,"name":"$91 Million in Bitcoin Stolen in Sophisticated Social Engineering Scam — CoinCentral","type":"news_article","url":"https://coincentral.com/91-million-in-bitcoin-stolen-in-sophisticated-social-engineering-scam/"},{"credibility":3,"name":"Investor Loses 783 BTC in Crypto Scam, Funds Laundered via Wasabi — Yellow.com","type":"news_article","url":"https://yellow.com/news/investor-loses-783-btc-in-crypto-scam-funds-laundered-via-wasabi"},{"credibility":2,"name":"Police Arrest Two People Related to $243M Crypto Heist Targeting Genesis Creditor — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2024/09/19/police-arrests-two-people-related-to-243m-crypto-heist-targeting-genesis-creditor"},{"credibility":2,"name":"ZachXBT helps secure arrests in $243 million social engineering attack — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/zachxbt-helps-secure-arrests-in-243m-social-engineering-attack-on-one-person/"},{"credibility":2,"name":"Blockchain sleuth ZachXBT alleges three attackers in $243M theft — The Block","type":"news_article","url":"https://www.theblock.co/post/317349/blockchain-sleuth-zachxbt-alleges-three-perps-involved-in-243-million-theft-of-single-genesis-creditor"},{"credibility":2,"name":"Crypto sleuth ZachXBT claims British threat actor tied to $243M Genesis creditor theft likely arrested — The Block","type":"news_article","url":"https://www.theblock.co/post/381481/crypto-sleuth-zachxbt-claims-british-threat-actor-tied-to-243-million-genesis-creditor-theft-likely-arrested"},{"credibility":2,"name":"Massive $243 million crypto heist ends with multiple arrests and asset frozen — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/crypto-heist-arrests-millions/"},{"credibility":1,"name":"California Money Launderer Sentenced to 70 Months for Role in Scheme that Stole $263 Million — US DOJ","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/california-money-launderer-sentenced-dc-70-months-role-scheme-stole-263-million"},{"credibility":2,"name":"22-year-old sentenced to 70 months for money laundering tied to $263M crypto syndicate — The Block","type":"news_article","url":"https://www.theblock.co/post/398899/22-year-old-sentenced-to-70-months-for-money-laundering-tied-to-263-million-crypto-syndicate"},{"credibility":2,"name":"Hacker steals $282 million crypto from a victim in social-engineering attack — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/01/16/hacker-steals-usd282-milion-in-hardware-wallet-social-engineering-attack"},{"credibility":2,"name":"ZachXBT on X — $282M hardware wallet theft disclosure (January 2026)","type":"social_media","url":"https://x.com/zachxbt/status/2012212936735912351"},{"credibility":2,"name":"The Largest Hardware Wallet Exploit of 2026: Inside the $116M Coldcard Hack — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack"},{"credibility":1,"name":"Bitcoin owners rocked by $116 million hack: What we know about the Coldcard exploit — Fortune","type":"news_article","url":"https://fortune.com/2026/08/03/bitcoin-owners-116-million-hack-coldcard-coinkite-exploit/"},{"credibility":1,"name":"Hackers steal over $130M by exploiting bug in offline hardware wallets — TechCrunch","type":"news_article","url":"https://techcrunch.com/2026/08/04/hackers-steal-over-130-million-by-exploiting-bug-in-offline-hardware-wallets/"},{"credibility":2,"name":"Hardware Wallet Firms Warn of Phishing Surge as Coldcard Losses Near $130M — Decrypt","type":"news_article","url":"https://decrypt.co/374891/hardware-wallet-firms-warn-of-phishing-surge-as-coldcard-losses-near-130m"},{"credibility":2,"name":"Hardware Wallet Makers Warn of Phishing After Coldcard Incident — ForkLog","type":"news_article","url":"https://forklog.com/en/hardware-wallet-makers-warn-of-phishing-after-coldcard-incident/"},{"credibility":2,"name":"Hardware Wallet Providers Flag Dangerous Phishing Campaign — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/hardware-wallet-phishing-campaign-warning/"}],"summary":"On August 19, 2025, a single victim lost 783 BTC (approximately $91 million at the time) after attackers impersonated customer support representatives for both a hardware wallet manufacturer and a cryptocurrency exchange. The stolen funds were routed through Wasabi Wallet's CoinJoin mixing service to obstruct traceability. Blockchain investigator ZachXBT publicly disclosed the theft on August 21, 2025, noting it occurred exactly one year after the $243 million Genesis creditor social engineering theft of August 19, 2024. This incident and its successor threats constitute a documented category-level attack pattern targeting high-net-worth Bitcoin holders through trusted-service impersonation, particularly dangerous in the August 2026 environment following the Coldcard firmware exploit and associated phishing surge.","timeline":[{"date":"2024-08-19","event":"A single Genesis bankruptcy creditor loses approximately 4,064 BTC (~$243 million) in a social engineering attack. Perpetrators impersonate Google support and Gemini exchange support, then use AnyDesk screen-share to steal private keys.","source":"The Block / CoinDesk","source_url":"https://www.theblock.co/post/317349/blockchain-sleuth-zachxbt-alleges-three-perps-involved-in-243-million-theft-of-single-genesis-creditor"},{"date":"2024-09-18","event":"Malone Lam and Jeandiel Serrano are arrested in Miami and Los Angeles respectively in connection with the $243M Genesis creditor theft, charged with conspiring to steal and launder cryptocurrency.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2024/09/19/police-arrests-two-people-related-to-243m-crypto-heist-targeting-genesis-creditor"},{"date":"2025-08-19","event":"A single victim loses 783 BTC (~$91 million) after attackers impersonate customer support representatives for a hardware wallet manufacturer and a cryptocurrency exchange. The theft occurs exactly one year after the $243M Genesis creditor attack. Funds are moved immediately to a Bitcoin address beginning bc1qyxyk4qgyrkx4rjwsuevug04wahdk6uf95mqlej.","source":"ZachXBT via Telegram / Decrypt / CoinDesk","source_url":"https://decrypt.co/336279/bitcoin-investor-loses-91-million-to-social-engineering-scam-zachxbt"},{"date":"2025-08-21","event":"ZachXBT publicly discloses the $91M theft via his Telegram investigations channel, noting the anniversary timing and the use of Wasabi Wallet for laundering. He advises: 'Assume that every call or email received is a scam by default.'","source":"ZachXBT Telegram / CoinDesk / Decrypt","source_url":"https://www.coindesk.com/business/2025/08/21/victim-loses-usd91m-in-bitcoin-after-social-engineering-scam-zachxbt"},{"date":"2026-01-10","event":"A victim loses $282 million in BTC and Litecoin in a hardware wallet social engineering scam. Attacker converts stolen assets to Monero via multiple instant exchanges, causing XMR price to surge ~70% over four days. ZachXBT confirms North Korean involvement is not suspected.","source":"CoinDesk / ZachXBT on X","source_url":"https://www.coindesk.com/business/2026/01/16/hacker-steals-usd282-milion-in-hardware-wallet-social-engineering-attack"},{"date":"2026-07-30","event":"Coldcard firmware exploit discovered: a 2021 build configuration error reduces private key entropy to ~40 bits on older devices. Wave 1 drains approximately 1,083 BTC (~$70 million) from over 500 addresses in 41 minutes. At least 15 independent attackers eventually exploit the flaw.","source":"Fortune / TRM Labs / TechCrunch","source_url":"https://fortune.com/2026/08/03/bitcoin-owners-116-million-hack-coldcard-coinkite-exploit/"},{"date":"2026-08-03","event":"Proofpoint documents a coordinated phishing campaign impersonating Coldcard, inviting users to complete a 'coordinated hardware audit.' The cloned site deploys ScreenConnect remote access software; a human operator staffs fake support chat to assist victims in installing it.","source":"Decrypt / Crypto Economy","source_url":"https://decrypt.co/374891/hardware-wallet-firms-warn-of-phishing-surge-as-coldcard-losses-near-130m"},{"date":"2026-08-04","event":"Total Coldcard exploit losses reach approximately $116–130 million across 5,200+ addresses. Trezor and Foundation issue warnings about phishing surges targeting hardware wallet users.","source":"TechCrunch / Decrypt","source_url":"https://techcrunch.com/2026/08/04/hackers-steal-over-130-million-by-exploiting-bug-in-offline-hardware-wallets/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 96247965-3ee5-4c1b-9a20-d297b236b0b6copy