A firmware bug in Coinkite's Coldcard hardware wallets has compromised more than 4,585 Bitcoin owners. The flaw affected devices manufactured between March 2021 and last week, with no distinction between wallets using passphrases and those without. So far, the identity of whoever exploited the vulnerability remains unknown.
If your coins are gone, speed matters. Move any remaining funds to a new, clean address immediately. Then gather everything, because law enforcement and insurance companies will want proof: transaction IDs, the addresses that were drained, balance screenshots before the loss, purchase receipts, and a timeline of when you first noticed the theft.
Filing reports and working with authorities
Start with your local police department. A formal report matters even if they lack crypto expertise, because it becomes the foundation for insurance claims or civil lawsuits. When you file, ask the officer directly whether you should contact the FBI yourself or whether they'll submit a report on your behalf.
The FBI's Internet Crime Complaint Center, IC3, handles federal crypto theft cases. You can file at https://complaint.ic3.gov. Victims over 60 with accessibility issues can call the FBI's Elder Fraud Hotline at (833) 372-8311 instead. Bring all your documentation to either channel.
Watch for scammers pretending to help
Here's the trap: once word spreads about a breach, con artists flood victims with messages claiming to be law enforcement or recovery services. IC3 explicitly states it doesn't work with law firms or crypto companies to recover funds, and it will never contact you first asking for information or money.
Don't trust unsolicited calls, texts, or emails from anyone claiming to represent the FBI or IC3. You initiate contact with authorities, not the other way around. If someone reaches out to you offering to retrieve your coins, they're running a scam.
Coinkite founder Rodolfo Novak apologized publicly, saying he's "devastated" and pledged the company will work with affected users pursuing police reports, insurance claims, or their own investigations. That's a start, but your immediate focus should be protecting what you have left and documenting everything for the officials who can actually help.
This article is informational only and should not be construed as financial or legal advice. Consult qualified professionals regarding your specific situation.
