Funds allegedly connected to the Coldcard vulnerability are already on the move and flowing to third-party platforms as criminals attempt to launder them.
Alex Thorn, Head of Research at Galaxy Digital, highlighted the behavior of Duel Casino, an online gambling platform that is claimed to have received nearly 230 ETH as a result of the Coldcard hack.
According to Thorn, the platform refused to freeze these funds even after receiving data linking the addresses and transactions to this incident. In response, Duel asked for a police report to be filed, despite allegedly already having access to the incriminating information.
Thorn called Duel's inaction outrageous, emphasizing that a police report would, at best, not arrive until Monday.
"These shady people refuse to freeze funds that have been proven through forensic analysis to be the result of an actual cyber incident. If they do not freeze these funds, they will become accomplices to the theft," he stated.
A member of the Duel team, known on X by the handle Korra, emphasized that they cannot freeze a user's funds just because a third party claims they are stolen, as people could potentially abuse this system for their own gain.
Korra then suggested making an exception if the alleged victim sends a message from the "hacked" address, signs a written statement confirming their account was hacked, and provides the transaction chain proving these funds were sent to Duel's wallets.
"You have to understand why this policy exists: we require SOME official confirmation that a theft actually occurred (i.e., typically confirmation from law enforcement of any kind), otherwise anyone could make any claim about their own balance, about a counterparty, or about a third party they don't even know, and get accounts frozen," Korra emphasized.
Duel Casino's policy has caused dissatisfaction among some users, who criticized the gambling platform for not imposing a temporary freeze on these funds while investigating the source of the funds mentioned in the claim.
Despite this, Korra reaffirmed Duel Casino's position.
"We don't block your balance in Duel just because someone asks us to. We simply don't do it. I'm very sorry, but that's how it is, and we will stick to this position," concluded Korra.
Former Delphi Digital Chief Legal Officer Gabriel Shapiro supported Duel Casino's stance: "This remains perhaps my only unpopular opinion, but I still believe it's practically the only sensible policy a fintech/crypto-related application can have..." he noted.
As more wallets are being drained and the perpetrators attempt to cash out part of the more than 1,300 stolen BTC, it should be expected that more users, companies, and institutions will face similar dilemmas.
