A highly coordinated Bitcoin theft on July 30 drained approximately 594.5 BTC, worth around $38 million, from 500 separate addresses in just 15 minutes, raising concerns that weak private-key generation may have exposed wallets to attack.
The operation unfolded across four consecutive Bitcoin blocks, with investigators now examining whether insufficient randomness during wallet creation allowed the attacker to reconstruct private keys.
500 Addresses Swept Across Four Bitcoin Blocks
The attack began at approximately 01:36 UTC, when the first group of suspicious transactions appeared in Bitcoin block 960188.
By block 960191, around 15 minutes later, the operation was complete.
According to an analysis of blockchain data by Atlas21, the attacker executed 500 transactions targeting 500 individual addresses, consuming 1,324 unspent transaction outputs (UTXOs).
Together, the addresses contained approximately 594.5 BTC.
The attacker subsequently consolidated around 562 BTC into a new address, while additional funds remained at an intermediate address.
The entire operation reportedly cost just 0.044 BTC in transaction fees.
Victims Appear to Have Been Carefully Selected
The distribution of stolen funds suggests the attacker may have identified targets before launching the coordinated sweep.
Among the affected addresses, 419 contained only one UTXO, while some had accumulated large numbers of deposits. One address contained 200 UTXOs and another held 105.
Such patterns can occur when users repeatedly withdraw Bitcoin from exchanges to the same wallet address.
The median loss was approximately 0.41 BTC, while 110 addresses lost more than 1 BTC.
The largest individual loss was reportedly 29.9 BTC, worth nearly $2 million at the referenced market price.
Notably, none of the targeted addresses contained less than 0.15 BTC, potentially indicating that the attacker filtered wallets according to minimum balances.
Coldcard Wallet Reports Trigger Investigation
Public attention intensified after a Reddit user reported that one of their wallets had been completely drained.
The user said they had purchased a Coldcard hardware wallet in 2021 and generated a 24-word recovery phrase directly on the device. According to their account, the seed had never been entered into a computer.
The same recovery phrase was later entered into another Coldcard device in 2025 to verify the backup.
Despite the wallet reportedly remaining largely dormant, its Bitcoin was swept alongside hundreds of other addresses.
Additional Bitcoin users subsequently reported similar unexplained losses, leading researchers to investigate whether affected wallets shared a common technical characteristic.
Weak Entropy Emerges as Leading Hypothesis
One of the main theories being investigated involves weak entropy during private-key or seed generation.
Cryptocurrency wallets rely on high-quality randomness when generating private keys. If that randomness is insufficient or predictable, an attacker who discovers the weakness may be able to recreate potential keys computationally.
That would allow funds to be stolen without compromising the victim’s computer, obtaining their recovery phrase or physically accessing their hardware wallet.
Researchers noted similarities with previous wallet vulnerabilities such as Milk Sad and Randstorm, where weaknesses in random-number generation exposed cryptocurrency wallets to key reconstruction.
However, the exact source of the suspected weakness in the July 30 incident remains under investigation.
Attack Pattern Provides Important Clues
Analysis of the affected addresses has revealed several notable characteristics.
All known victims used single-signature wallets, while no multisignature wallets were identified among the affected UTXOs.
Researchers also found no Taproot addresses among the initial victim set.
Of the 500 addresses analysed by Atlas21, approximately 490 were native SegWit addresses, while five were legacy addresses and another five used nested SegWit.
The attacker also executed one transaction for each targeted address rather than sweeping complete wallets through a single transaction.
That pattern could indicate that the attacker obtained or reconstructed individual private keys rather than complete wallet seed phrases.
Reports that only certain UTXOs were stolen from some wallets could provide another clue about how the attacker identified vulnerable keys.
Coldcard Comes Under Scrutiny
Coldcard manufacturer Coinkite initially cautioned against assuming that its hardware was responsible, saying the incident appeared to involve a broader group of compromised private keys.
Subsequent investigation has nevertheless increased scrutiny of seeds generated by certain Coldcard Mk3 devices.
Coinkite has separately warned users who generated seeds on Coldcard Mk3 firmware version 4.0.1 through 5.0.3 that their funds could potentially be at risk while the company investigates a seed-generation security issue.
The precise relationship between that issue and the July 30 Bitcoin drains has not yet been definitively established.
Multisig Wallets Were Not Among Known Victims
One of the clearest observations from the available blockchain data is the absence of multisignature wallets among the affected outputs.
Multisig configurations require multiple independent private keys to authorize transactions. If the vulnerability affected only one particular key-generation process, independently generated keys could significantly reduce the likelihood of an attacker gaining sufficient credentials to move funds.
Security researchers have therefore highlighted multi-device and multi-vendor multisignature setups as one potential method for reducing exposure to failures involving a single wallet implementation.
However, researchers have cautioned that the exact attack vector must still be confirmed before definitive conclusions can be drawn.
More Than 562 BTC Remains Under Observation
The attacker reportedly consolidated approximately 562 BTC into a single address, while roughly another 32 BTC remained at an intermediate location at the time of the original analysis.
Those funds had not yet been moved to a cryptocurrency exchange or mixing service.
Their next movement could therefore provide investigators with valuable information.
If the Bitcoin eventually reaches an identifiable centralized platform, blockchain investigators and exchanges may gain additional opportunities to trace the funds and potentially connect the transactions to an individual or organization.
For now, the incident remains an active investigation, but its structure points toward a potentially serious lesson for Bitcoin custody: a hardware wallet can only be as secure as the randomness used to create its private keys.
