Coldcard attack investigation hits AI limitations, Galaxy Research head says forced to turn to Chinese open-source models to trace stolen funds
Odaily Planet Daily News Galaxy Research head of research Alex Thorn stated that the attack targeting addresses generated by Coldcard wallets is ongoing. The team is continuously collecting victim information and adding new victim addresses and attacker addresses to the investigation database. If users are still using affected Coldcard single-signature addresses, they should immediately migrate their funds. Based on current investigation findings, all single-signature Coldcard addresses generated after the March 2021 firmware upgrade could ultimately be drained by the attacker—it's only a matter of time. According to Galaxy Research's analysis, the three confirmed rounds of attacks so far exhibit highly programmatic characteristics, with similar attack transaction patterns. A large amount of stolen bitcoin remains dormant in attacker addresses and has not yet been moved. However, new opportunistic attackers are emerging simultaneously, laundering funds through peeling chains, cross-chain services (such as ThorChain), and offshore gambling platforms.
Additionally, Alex Thorn also mentioned the limitations of AI tools in security investigations, noting that some U.S. large language models restrict researchers' ability to trace stolen funds. The team has even had to turn to Chinese open-source AI models to assist in protecting user assets and conducting on-chain tracing. He described this phenomenon as "unbelievable" and plans to push for discussions on related issues at both government and industry levels. Alex Thorn concluded by stating that a large amount of stolen funds currently remains static, the team is continuously monitoring related addresses, and information has been shared with relevant U.S. agencies and industry partners. He called on the bitcoin community to learn lessons from this incident, strengthen self-custody security education, and raise awareness of wallet complexity.
