On August 19, new developments emerged regarding the Coldcard hardware wallet theft that occurred in July 2026. The Bitkey team under Block discovered that the initial attackers had used a paid account from a well-known blockchain data service provider to query the affected addresses. Internal logs from the relevant platform showed a high degree of matching in terms of request volume, timing, and execution sequence, suggesting that law enforcement may have identified the attackers. Previous tracking by Galaxy Research indicated that the first wave of attacks transferred 1,082.65 BTC, which remains in the attackers' addresses. The total losses from this Coldcard vulnerability incident have exceeded 1,800 BTC, affecting over 5,000 addresses. Investigations revealed that the attack stemmed from a random number generation vulnerability in some Coldcard firmware, resulting in insufficient entropy for private key generation, allowing attackers to compute and crack the wallets. Coldcard has since released a fix and urged affected users to migrate their funds as soon as possible.