Coldcard attack investigation hits AI limitations, Galaxy research head says forced to turn to Chinese open-source models to trace stolen funds

Odaily News Galaxy Research head Alex Thorn stated that the attack targeting Coldcard wallet-generated addresses is still ongoing. The team is continuously collecting victim information and adding new victim addresses and attacker addresses to the investigation database. If users are still using affected Coldcard single-signature addresses, they should immediately migrate their funds. According to current investigation findings, all single-signature Coldcard addresses generated after the March 2021 firmware upgrade could ultimately be drained by attackers—it is only a matter of time. According to Galaxy Research's analysis, the three confirmed rounds of attacks so far exhibit highly programmatic characteristics, with similar attack transaction patterns. A large amount of stolen Bitcoin remains sitting in attacker addresses and has not yet been moved. At the same time, some new opportunistic attackers are emerging, transferring and laundering funds through peeling chains, cross-chain services (such as ThorChain), and offshore gambling platforms.

Additionally, Alex Thorn also mentioned the limitations of AI tools in security investigations. Some major U.S. language models have restricted researchers' ability to trace stolen funds, forcing the team to turn to Chinese open-source AI models to assist in protecting user assets and conducting on-chain tracing. He described this situation as "unbelievable" and plans to push for discussions on related issues at both the government and industry levels. Alex Thorn concluded by noting that a large portion of the stolen funds remains dormant, with the team continuously tracking the relevant addresses and sharing information with relevant U.S. agencies and industry partners. He called on the Bitcoin community to learn from this incident, strengthen self-custody security education, and raise awareness of wallet complexity.