Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #10[disputed][awaiting moderator]in section: Escalation: $282M Hardware Wallet Theft (January 10, 2026)

   “CoinDesk reported this as 'the largest individual social engineering theft in cryptocurrency history' at the time of publication.”

   reviewerCoinDesk reported the $282M theft as 'the largest individual social engineering theft in cryptocurrency history.'The characterization of the theft as a record is well supported across crypto media generally, but it is misattributed to the specific CoinDesk article cited here, which does not contain this quote.
   Proposed correction (not yet applied)

   Other crypto outlets reported this as 'the largest individual social engineering theft in cryptocurrency history' at the time of publication.
   citedwww.coindesk.com/business/2026/01/16/hac…gineering-attack
2. #12[disputed][awaiting moderator]in the timeline

   “Wave 1 drains approximately 1,083 BTC (~$70 million) from over 500 addresses in 41 minutes.”

   reviewerWave 1 of the Coldcard exploit drained approximately 1,083 BTC (~$70 million) from over 500 addresses in 41 minutes.The page's own cited source gives 1,196 addresses for this 1,083 BTC/41-minute wave, not 'over 500.' The ~500 figure appears to have been conflated from a separate, smaller sweep (594 BTC from ~500 wallets over 25 minutes) described in a different source (TRM Labs).
   Proposed correction (not yet applied)

   Wave 1 drains approximately 1,083 BTC (~$70 million) from 1,196 addresses in 41 minutes.
   citedfortune.com/2026/08/03/bitcoin-owners-11…oinkite-exploit/
3. #14[disputed][awaiting moderator]in section: Threat Environment: Coldcard Firmware Exploit (August 2026)

   “inviting holders to complete a 'coordinated hardware audit'”

   reviewerProofpoint documented a phishing campaign in which Coldcard-impersonating emails invited holders to complete a 'coordinated hardware audit.'The rest of the description (cloned site, batch file, ScreenConnect, DocuSign decoy, human-staffed chat) matches the cited BleepingComputer article closely; only the quoted campaign name is wrong.
   Proposed correction (not yet applied)

   inviting holders to complete a 'coordinated security audit'
   citedwww.bleepingcomputer.com/news/security/c…ote-access-tool/
4. #15[disputed][awaiting moderator]in the timeline

   “inviting users to complete a 'coordinated hardware audit.'”

   reviewerProofpoint documented a phishing campaign in which Coldcard-impersonating emails invited users to complete a 'coordinated hardware audit.'Same underlying error as the sections[5] finding, repeated in the timeline entry for the same event.
   Proposed correction (not yet applied)

   inviting users to complete a 'coordinated security audit.'
   citeddecrypt.co/374891/hardware-wallet-firms-…losses-near-130m

No source the reviewer could reach confirms or contradicts the claim.

1. #7[unverifiable][awaiting moderator]in section: Precedent: The $243M Genesis Creditor Theft (August 19, 2024)

   “The victim was also persuaded to share their screen via AnyDesk remote desktop software, revealing Bitcoin private keys.”

   reviewerThe Genesis creditor victim was persuaded to share their screen via AnyDesk remote desktop software, revealing Bitcoin private keys.The naming of AnyDesk specifically is widely repeated in secondary crypto-media coverage but was not confirmed in the tier-1/2 sources checked directly; not contradicted either, so unverifiable rather than disputed.
   citedwww.theblock.co/post/317349/blockchain-s…genesis-creditor
2. #13[unverifiable][awaiting moderator]in section: Threat Environment: Coldcard Firmware Exploit (August 2026)

   “At least 15 independent attackers were identified; total losses across four waves reached approximately 1,816–2,055 BTC ($116–130 million) from over 5,200 addresses.”

   reviewerAt least 15 independent attackers were identified in the Coldcard exploit.No source consulted, including the page's own cited sources, states a specific figure of 15 attackers; reporting ranges from 'a dozen' to ~600 attacker-controlled wallets with an explicitly unclear unique-attacker count. The accompanying loss total (1,816-2,055 BTC / $116-130M) is independently well supported by TRM Labs (1,816 BTC/$116M) and a later Rekt.news estimate (~2,055 BTC/~$130M).
   citedwww.trmlabs.com/resources/blog/the-large…on-coldcard-hacktechcrunch.com/2026/08/04/hackers-steal-…ardware-wallets/
3. #17[unverifiable][awaiting moderator]in section: Precedent: The $243M Genesis Creditor Theft (August 19, 2024)

   “The case is reported to be the first Bitcoin-related RICO prosecution in US history.”

   reviewerThe $243M Genesis creditor case is reported to be / has been characterized as the first Bitcoin-related RICO prosecution in US history.Could not find any source confirming or denying the 'first' superlative. The page already hedges this with 'is reported to be' / 'has been characterized as,' which is appropriate given the uncertainty. An identical hedged claim is repeated almost verbatim in sections[8] ('The case has been characterized as the first Bitcoin-related RICO prosecution in US history.').

The claim was accurate when written but events since have overtaken it.

1. #16[stale][awaiting moderator]in section: Legal Proceedings: $243M Theft Arrests and Prosecution

   “As of May 2026, Malone Lam's sentencing in the primary case had not concluded, with plea negotiations reported as ongoing through early 2026.”

   reviewerAs of May 2026, Malone Lam's sentencing in the primary case had not concluded, with plea negotiations reported as ongoing through early 2026.This sentence was not supported by any cited source in the page (none covers this), and more recent reporting from September 2026 shows the situation has moved past 'plea negotiations' to an actual guilty plea, rendering the 'As of May 2026... ongoing through early 2026' framing stale.
   Proposed correction (not yet applied)

   As of September 2026, Malone Lam had pleaded guilty to one count of racketeering conspiracy in the primary case, with a status hearing scheduled for December 8, 2026, and no sentencing date yet announced.

The cited evidence supports part of the claim but not all of it.

1. #3[partially supported][awaiting moderator]in section: Fund Laundering: Wasabi Wallet and CoinJoin

   “The theft transaction hash reported in secondary sources is da598f2a941ee3c249a3c11e5e171e186a08900012f6aad26e6d11b8e8816457, though this should be independently verified on-chain.”

   reviewerThe theft transaction hash was reported in secondary sources.The hash itself is accurate (confirmed on-chain), but none of the section's three cited secondary sources actually report it, so the sourcing characterization is incorrect even though the underlying fact is true.
   citedcrypto-economy.com/zachxbt-traces-91m-bi…llet-and-mixers/yellow.com/news/investor-loses-783-btc-i…dered-via-wasabi

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in section: Incident Overview

   “On August 19, 2025, a single individual lost 783 BTC — valued at approximately $91 million at the time of the theft — to a social engineering attack.”

   reviewerA single individual lost 783 BTC (~$91 million) to a social engineering attack on August 19, 2025.Core facts of the theft (amount, date, valuation) are corroborated by the cited Decrypt and CoinDesk articles.
   citeddecrypt.co/336279/bitcoin-investor-loses…ing-scam-zachxbtwww.coindesk.com/business/2025/08/21/vic…ing-scam-zachxbt
2. #2[confirmed][no action needed]in section: Fund Laundering: Wasabi Wallet and CoinJoin

   “After the theft, the 783 BTC were transferred to a new Bitcoin address beginning with bc1qyxyk4qgyrkx4rjwsuevug04wahdk6uf95mqlej before being deposited into Wasabi Wallet, a privacy-focused Bitcoin wallet that implements the CoinJoin protocol.”

   reviewerStolen funds were moved to a Bitcoin address beginning bc1qyxyk4qgyrkx4rjwsuevug04wahdk6uf95mqlej in a transaction with hash da598f2a941ee3c249a3c11e5e171e186a08900012f6aad26e6d11b8e8816457.Verified directly against blockchain data rather than the cited news articles, none of which actually publish this address or hash (see separate sourcing finding). The fact itself checks out exactly: 783.75431401 BTC moved in one transaction to this address.
   citedcrypto-economy.com/zachxbt-traces-91m-bi…llet-and-mixers/
3. #4[confirmed][no action needed]in section: Precedent: The $243M Genesis Creditor Theft (August 19, 2024)

   “On August 19, 2024, a Genesis bankruptcy creditor lost approximately 4,064 BTC (then valued at approximately $230–243 million) in a social engineering attack executed by at least three individuals operating under the handles Greavys (Malone Lam, also reported as Malone Iam), Wiz (Veer Chetal), and Box (Jeandiel Serrano).”

   reviewerOn August 19, 2024, a Genesis bankruptcy creditor lost ~4,064 BTC (~$230-243M) via Google/Gemini support impersonation by Greavys (Malone Lam), Wiz (Veer Chetal), and Box (Jeandiel Serrano).Well supported. Note that later reporting (2025-2026 superseding indictment) revises the scheme total upward to $245-263M as more victims were added, which the page's later Legal Proceedings section does separately acknowledge.
   citedwww.theblock.co/post/317349/blockchain-s…genesis-creditor
4. #5[confirmed][no action needed]in section: Precedent: The $243M Genesis Creditor Theft (August 19, 2024)

   “Malone Lam (Miami) and Jeandiel Serrano (Los Angeles) were arrested on September 18, 2024, and charged with conspiring to steal and launder cryptocurrency.”

   reviewerMalone Lam and Jeandiel Serrano were arrested on September 18, 2024, in Miami and Los Angeles respectively, charged with conspiring to steal and launder cryptocurrency.Confirmed by CoinDesk and corroborated by multiple other outlets.
   citedwww.coindesk.com/business/2024/09/19/pol…genesis-creditor
5. #6[confirmed][no action needed]in section: Legal Proceedings: $243M Theft Arrests and Prosecution

   “A third suspect, Veer Chetal (handle: Wiz), was subsequently apprehended by US Marshals.”

   reviewerA third suspect, Veer Chetal (handle Wiz), was subsequently apprehended by US Marshals.Confirmed, though the page omits the specific arrest date (March 25, 2025) and the subsequent re-detention after an unrelated $2M theft allegation, which would strengthen this section.
   citedcryptoslate.com/zachxbt-helps-secure-arr…k-on-one-person/
6. #8[confirmed][no action needed]in section: Escalation: $282M Hardware Wallet Theft (January 10, 2026)

   “On January 10, 2026, a further escalation in this attack pattern was documented by ZachXBT: a victim lost $282 million in BTC and Litecoin due to a hardware wallet social engineering scam.”

   reviewerOn January 10, 2026, a victim lost $282 million in BTC and Litecoin; attacker converted to Monero via instant exchanges, causing a ~70% XMR surge over four days, with some BTC bridged via THORChain to Ethereum, Ripple and Litecoin.Fully supported by the cited CoinDesk article.
   citedwww.coindesk.com/business/2026/01/16/hac…gineering-attack
7. #9[confirmed][no action needed]in section: Escalation: $282M Hardware Wallet Theft (January 10, 2026)

   “ZachXBT stated that North Korean state-sponsored hackers were not involved, suggesting a non-state actor.”

   reviewerZachXBT stated that North Korean state-sponsored hackers were not involved in the $282M theft.Confirmed verbatim in substance.
   citedwww.coindesk.com/business/2026/01/16/hac…gineering-attack
8. #11[confirmed][no action needed]in section: Threat Environment: Coldcard Firmware Exploit (August 2026)

   “A build configuration error introduced in Coldcard firmware version 4.0.1 (March 2021) caused seed generation to fall back on a software-based pseudorandom number generator rather than the device's hardware entropy source, reducing effective key strength to as little as 40 bits on older Mk3 devices.”

   reviewerA Coldcard firmware build configuration error in version 4.0.1 (March 2021) fell back to a software PRNG, reducing effective key strength to as little as 40 bits on older Mk3 devices.Confirmed across TRM Labs and independent technical write-ups (Bitcoin Optech, PhishFort) which specifically attribute the ~40-bit figure to Mk3 devices.
   citedwww.trmlabs.com/resources/blog/the-large…on-coldcard-hack