THE ATTACKER LEFT A PAID-ACCOUNT PAPER TRAIL — BLOCK ENGINEERING TRACES THE COLDCARD OPERATOR.

Block engineer Clay Garrett published the attribution work on X and CoinDesk carried the technical explainer. During Block’s investigation of the ColdCard sweeps, engineering identified an unusual pattern in how the drained addresses were being queried before the funds moved. That pattern pointed at a paid account at a known blockchain-data provider. When Block cross-referenced the provider’s internal request logs against the sweep timeline, the match was “extraordinary” — the same number of queries, the same timing gaps, the same sequencing. Block has passed the information to authorities.

The mechanism of the drain itself was the opposite of what most people picture when they hear “hardware wallet compromise.” No device was touched. The victim ColdCards were sitting powered off in safes and drawers when the theft ran. The attacker generated candidate seeds on their own hardware, derived the addresses those seeds would produce, and swept the public blockchain looking for balances. Galaxy Research mapped 1,082.65 BTC drained in a 41-minute window across three address formats (native segwit plus two older standards), which is what systematic enumeration looks like — not victim targeting.

The Technologist read: even in the failure mode — a private-key generation process quietly bypassed for five years — the attribution machinery still worked. Operational security is hard to maintain across a multi-week sweep operation, and this attacker didn’t. The provider account, the query pattern, the timing signature: every one of those is a fingerprint. The bearer asset does not require attribution to be enforceable, but when attribution is available, it belongs on the record. The private-key math failed at the wallet layer. The forensic trace at the network layer did not.