ZachXBT Won't Chase $88.6M Coldcard Exploit, Citing Lack of Backing From Bitcoin Community

Blockchain sleuth ZachXBT says he does not plan to trace the $88.6 million Coldcard hack, arguing that bitcoin holders have offered little support for years despite his past work. In a post on X, the onchain investigator said he is prioritizing ecosystems that value his investigations. He added that Bitcoin maximalists are not donors or supporters of his work, leaving him with "less obligation" to step in. His comments come as the Coldcard incident moved into its fifth day and losses continued to mount. ZachXBT has previously handled major cases pro bono, underscoring what he framed as a gap between the effort expected from him and the goodwill he receives from the Bitcoin community. The breach stems from a firmware flaw in hardware wallets produced by Canadian manufacturer Coinkite. The issue affected Coldcard Mk3 devices running versions 4.0.1 through 4.1.9. Under certain conditions, the wallets generated seed entropy using a software random-number generator rather than the device's dedicated hardware chip, making some seeds guessable. The first wave struck July 30, when about 594 BTC—worth roughly $38 million at the time—was drained from nearly 500 dormant addresses in less than 30 minutes. Coinkite released patched firmware within two days, but subsequent waves followed. By Aug. 2, Galaxy Research said it had tracked cumulative losses of 1,367 BTC, valued at $88.6 million, pulled from 4,585 addresses across three attack waves. The speed and accuracy of the thefts have fueled speculation that automated tools, potentially AI-assisted, helped the attacker identify and empty vulnerable addresses within minutes of each sweep. The stolen funds have also shown rising exchange deposit activity, while older dormant BTC linked to the case has begun moving again. Coinkite's response has drawn its own backlash. The company emailed warnings to every customer address it could reach using store and newsletter records, including some dating to 2019. The outreach clashed with earlier statements from CEO Rodolfo Novak that customer data was erased 90 days after purchase and that anonymous buying options were available. Coinkite later acknowledged it retains purchase email addresses indefinitely and does not have a deletion policy for that data, triggering criticism separate from the hack itself. Novak has defended the firm's broader security record, saying competitors face breaches regularly and that Coinkite is taking the issue seriously. The episode is already weighing on confidence in self-custody and could steer more cautious investors toward exchange-traded funds rather than managing private keys directly. The case has also turned into a public spectacle: a bitcoin laundering offer directed at the hacker was posted onto Bitcoin's blockchain, amplifying the drama across social media and onchain data. With ZachXBT stepping back, more of the tracing effort falls to groups such as Galaxy Research, which has been publishing wave-by-wave updates as the attacker's wallet activity changes. Reports also suggest the entropy bug affecting Coldcard Mk3 devices dates back to a March 2021 firmware build, potentially leaving any seed generated on that version exposed for more than four years unless owners move to a fresh seed after applying the patched firmware.