Unchained · Tuesday, August 4, 2026
Alex Thorne strongly advises any Coldcard user with funds in single-signature or multi-sig addresses to move them immediately. The ongoing exploit, which began early Thursday UTC, has seen significant Bitcoin drains. Thorne is actively tracing funds and working with law enforcement and crypto intelligence firms to flag addresses and potentially aid in recovery.
“And before I even go any viewer or listener has funds on a Coldcard in any single signature address as an app part of a multi-sig quorum, you should move those coins off as soon as possible.”
“I am an expert in on-chain forensic tracing. And that's what I've been doing. I've been following the funds here and trying to identify victim and attacker addresses. And along with helping victims if they reach out to me, also submitting those addresses to relevant US federal government law enforcement, crypto exchanges, crypto Isaacs, Seal, all of the relevant cyber investigators to try to make sure that these addresses get flagged by chain analysis, uh, TRAM Labs, and all the exchanges so that if they do appear at a centralized intermediary, there's a chance of recovery.”