Research Suggests Coldcard Attacker Targeted Bitcoin Addresses by Balance

A new study by @PraveenPerera suggests that the Coldcard attacker first identified vulnerable addresses, then sorted them by the amount of Bitcoin held before moving funds in batches from the largest holdings. According to Odaily, the transfer software used in the theft appeared crude, and the researchers said it may have failed to load additional pages of data from a blockchain API that returns 200 records by default.The report said one address had 225 spendable UTXOs, and the attacker extracted the latest 200 while leaving the oldest 25, including one UTXO worth 0.16 BTC. It also said the software spent a 294-satoshi UTXO, which reportedly increased transaction fees by about 2,040 satoshis and made the spending amount much larger than the UTXO’s own value.Based on this, the study’s author said the tool’s builder may have understood account-balance systems better than Bitcoin’s UTXO model. Although the attacker appears to have obtained the victim’s full seed, at least 75 BTC remained in other addresses derived from the same seed. The researchers said 132.95 BTC remained in 132 of the 153 stolen addresses, and they still could not reproduce the seed behind those addresses. They said they cannot rule out the possibility that the attacker obtained undisclosed private device data or candidate data.