Investigators link attackers to a blockchain data provider after 1,082.65 BTC was stolen via a hardware wallet vulnerability.
The FBI may have identified suspects behind the July 2026 theft of 1,082.65 BTC, valued at $11.8 million, from Coldcard hardware wallets. The attackers exploited a random number generator flaw in the libngu library, introduced in 2021, to crack private keys.
Block and Galaxy Research found the suspects used a paid blockchain data provider, with logs matching their onchain fund-sweeping patterns. The exploit affected multiple waves of attacks, though officials continue tracking additional incidents.
Coldcard’s vulnerability allowed attackers to compromise devices and drain funds, marking one of the largest hardware wallet breaches in recent years.