# Theft Related Articles

HTX News Center provides the latest articles and in-depth analysis on "Theft", covering market trends, project updates, tech developments, and regulatory policies in the crypto industry.

Galaxy Estimates Coldcard Hack Losses at 1,789 BTC: 87% of Bitcoins Unmoved

Researchers from Galaxy estimate that hackers stole 1,789.28 BTC (worth $114.7 million at the time) from the Coldcard hardware wallet exploit, linked to 8,865 addresses. According to Alex Thorn, head of Galaxy Research, the vast majority of the stolen funds—1,561 BTC, or 87.3% of the total—remain unmoved and are held in addresses controlled by the attackers. This includes all bitcoins stolen during the attack's first three waves. Some funds from later waves have been moved using obfuscation methods like CoinJoin transactions and peel chains. The assessment is partly based on 221 victim reports detailing losses of 790.72 BTC (44.2% of the estimated total), with a median loss per report of over 1 bitcoin. Galaxy has shared the identified attacker addresses with exchanges, compliance firms, and law enforcement to facilitate freezing the funds if they reach centralized intermediaries.

cryptonews.ru4h ago

Galaxy Estimates Coldcard Hack Losses at 1,789 BTC: 87% of Bitcoins Unmoved

cryptonews.ru4h ago

Bessent Urges Foreign Countries to Sever Ties with Iran in Digital Assets

U.S. Treasury Secretary Scott Bessent has launched "Operation Economic Outcast," described as an unprecedented, government-wide campaign targeting the economic lifelines of the Islamic Republic of Iran and its facilitators. The operation aims to sever Iran's use of digital assets to evade traditional sanctions, making this a key priority in efforts to paralyze the Iranian economy. The Treasury warns that any entity aiding Iran in money laundering or sanctions evasion risks being cut off from the U.S. financial system. The Office of Foreign Assets Control (OFAC) now has authority to sanction individuals globally operating in sectors of Iran's economy, including digital assets. Initial sanctions target an Iranian cyber group linked to the Ministry of Intelligence for cryptocurrency theft, naming several individuals. While countries like China, Iraq, Turkey, India, and Russia are identified as being significantly impacted by Iran-related activities, enforcement specifics remain unclear. The Treasury states that nations will be given a deadline to cease flagged activities, after which it will act unilaterally. The move follows previous actions where nearly $1 billion in Iranian crypto assets were seized, including $344 million in USDT from Tron addresses in April with Tether's cooperation.

cryptonews.ru8h ago

Bessent Urges Foreign Countries to Sever Ties with Iran in Digital Assets

cryptonews.ru8h ago

Unbelievable! Cosmos Publishes High-Risk Patch Without Prior Notice, Hackers 'Empty' Project Treasuries First

A series of preventable security attacks recently struck multiple Cosmos ecosystem blockchains—including MANTRA, TAC, KiiChain, and Nesa—all built using the Cosmos EVM module. Attackers drained protocol treasury wallets and dumped the stolen tokens, causing assets like KII, TAC, and NES to plunge over 90% within hours. The root cause was a critical security vulnerability. On August 19, Cosmos Labs publicly released version v0.7.2 on GitHub, containing an urgent security patch. However, they failed to privately notify or coordinate with the dependent project teams beforehand, leaving the exploit details openly accessible. This allowed malicious actors to study and execute attacks before most teams could respond. Affected projects like KiiChain criticized Cosmos Labs for bundling the critical fix with unrelated updates and not treating it with the necessary urgency, such as recommending chains to pause operations. The exploit combined three upstream flaws in the Cosmos EVM module, affecting any chain with vesting accounts enabled. Despite some teams, like MANTRA, identifying the issue early, attacks continued for days. Nesa’s token crashed 94% before the team halted its chain. Cosmos Labs eventually issued a belated response, advising chains to pause, but widespread criticism highlighted a severe failure in vulnerability disclosure, patch coordination, and ecosystem communication. This incident underscores deep flaws in Cosmos's security auditing, cross-chain coordination, and emergency response systems, further damaging confidence in an ecosystem already facing significant project departures and declining traction.

marsbit10h ago

Unbelievable! Cosmos Publishes High-Risk Patch Without Prior Notice, Hackers 'Empty' Project Treasuries First

marsbit10h ago

Unknown Parties Withdrew $7.5 Million from the TAC Blockchain

Unknown actors withdrew $7.5 million from the TAC blockchain, prompting developers to halt the network at block 24,671,475 to stop the attack. The hacker moved 2,985,651,403 TAC tokens between escrow accounts, but no new tokens were created, and only TAC was affected. The team is collaborating with crypto exchanges to track the funds and has frozen all transactions during the investigation. TAC (TON Application Chain) is a layer-1 blockchain bridging Ethereum, TON, and Telegram, enabling Ethereum-compatible dApps to run within Telegram. Its native token is used for gas fees, staking, and governance. A similar attack recently occurred on MANTRA Chain, which also uses the Cosmos EVM module for Ethereum compatibility, halting its operations as well. Additionally, the Term Labs decentralized protocol was hacked for about $8.5 million due to a governance vulnerability.

cryptonews.ru16h ago

Unknown Parties Withdrew $7.5 Million from the TAC Blockchain

cryptonews.ru16h ago

Coldcard Theft Reflection: Source Code Visibility Does Not Equal Security

The article examines the open-source vs. closed-source debate in crypto, prompted by a theft of over $100M in Bitcoin from Coldcard hardware wallets. It clarifies key terminology: true "Free and Open Source Software" (FOSS) grants four essential freedoms (use, study, share, modify), while "source available" code, like Coldcard's firmware, may have usage restrictions. The piece argues that visible source code alone does not guarantee security; actual safety depends on the economic incentives for thorough, ongoing review by skilled individuals. Using Bitcoin Core as a model, the article describes a successful, transparent open-source development culture built on public review and consensus. It contrasts this with the Coldcard case, where a critical bug in a lightly-reviewed, source-available library went undetected for years, highlighting a "tragedy of the commons" scenario where assumed but absent scrutiny creates vulnerability. The economics of licensing are crucial: restrictive licenses can limit the pool of motivated commercial reviewers. Finally, the article explores AI's impact. It cites the Bitcoin Red Team's use of AI to rapidly audit codebases and find vulnerabilities at scale, demonstrating a powerful new tool for security. However, AI also floods projects with low-quality code, straining maintainers. The piece concludes that in high-stakes crypto, only well-audited projects—whether open or closed-source—can withstand evolving threats, with AI both challenging and aiding security practices.

marsbit2 days ago 07:10

Coldcard Theft Reflection: Source Code Visibility Does Not Equal Security

marsbit2 days ago 07:10

Russian Suspected of Stealing Cryptocurrency from Cold Wallet Worth Almost 10 Million Rubles

Russian authorities are investigating a suspect accused of stealing nearly 10 million rubles worth of cryptocurrency from a cold wallet. According to investigators, the wallet belonged to an unnamed commercial company executive's assistant. In March, the suspect allegedly gained access to the victim's wallet by "an unidentified method" and transferred the digital assets to another address. During a search of the suspect's home, police seized three computers and three mobile phones for forensic examination, as they may contain important digital evidence. The case is being investigated as grand larceny under the Russian Criminal Code, carrying a potential sentence of up to ten years in prison. Police are also checking the suspect's possible involvement in other cryptocurrency thefts and identifying potential accomplices. The article notes that while cold wallets (hardware wallets storing private keys offline) are considered more secure against remote hacking, they remain vulnerable if a perpetrator gains physical or direct access to the keys. In a related case earlier in June, a court in Tomsk sentenced two men to 8 and 9.5 years in a strict-regime colony for a robbery and cryptocurrency theft. They forced an acquaintance at knifepoint to log into a crypto exchange account and transfer over 85 bitcoins, valued at approximately $5.1 million at the time.

cryptonews.ru08/19 22:17

Russian Suspected of Stealing Cryptocurrency from Cold Wallet Worth Almost 10 Million Rubles

cryptonews.ru08/19 22:17

Bitcoin Rescue from Coldcard Turns into Theft Due to Hacked Google Account

The story details a crypto investor who, while attempting to save their assets by moving $750,000 in Bitcoin from a Coldcard hardware wallet to a centralized exchange, had the funds stolen within 12 hours. The theft was attributed not to a blockchain or exchange flaw, but to a compromised Google account with cloud synchronization enabled for Google Authenticator. Following a 2023 update allowing automatic backup of 2FA codes to the cloud, this feature created a critical vulnerability. Once hackers gained control of the Google account, they accessed the synced authenticator codes, bypassing the exchange's security barriers. Experts note this effectively reduces two-factor authentication to a single, vulnerable point of failure. The article explains that such account compromises often occur via sophisticated phishing attacks or malware stealing session cookies, not brute force. The key lesson is that security cannot be compromised. Recommendations include disabling cloud sync in Google Authenticator for financial accounts, using offline hardware security keys, employing unique passwords, and isolating exchange accounts from everyday email. The incident underscores that a hardware wallet's security is nullified if the keys to a connected centralized exchange are left accessible via a single compromised cloud account.

cryptonews.ru08/17 18:39

Bitcoin Rescue from Coldcard Turns into Theft Due to Hacked Google Account

cryptonews.ru08/17 18:39

Hackers Stole Over 1700 BTC from Vulnerable Coldcard Wallets

Hackers stole over 1,778.84 BTC (worth $112.7 million) from vulnerable Coldcard hardware wallets. The attack, which began on July 30, 2026, exploited a years-old firmware bug introduced in 2021 by manufacturer Coinkite. The flaw created insufficient cryptographic entropy, allowing attackers to systematically reproduce private keys and drain funds from more than 8,600 addresses. Galaxy Research confirmed that while new victims continued to report losses, the last confirmed theft occurred on August 6, likely because most vulnerable funds had already been stolen or moved. The majority of the stolen BTC remains under hacker control, with funds being laundered through methods like CoinJoin and Peel Chain transactions. This incident struck users dedicated to self-custody, shaking confidence in hardware wallets as a secure storage method. In response, interest in multisignature wallets spiked, as no confirmed thefts involved multisig addresses. Galaxy also noted that attackers likely used unrestricted AI models to aid the exploit, highlighting a growing cybersecurity risk where powerful AI tools are more accessible to malicious actors than to defenders.

cryptonews.ru08/15 12:34

Hackers Stole Over 1700 BTC from Vulnerable Coldcard Wallets

cryptonews.ru08/15 12:34

Secretly Mined 1 BTC on Work Computers: Crypto Firm Employee Faces Prison

Christopher Rankin, a 40-year-old from Washington state, pleaded guilty to unauthorized access to computers at a bitcoin mining company and theft of cryptocurrency. While employed at the New York-based company starting in July 2021, Rankin gained unauthorized access to approximately 100 company computers. He manually rebooted them and redirected their mining power to a fraudulent mining pool he controlled, causing the mined bitcoin (1.0668 BTC, worth approximately $53,315 at the time) to be sent to wallets under his control. Additionally, he set the computers to a high-performance mode, which prosecutors stated caused physical damage, significantly reducing their lifespan, and compromised the integrity and availability of data stored on them. Rankin was found guilty of transmitting a program, information, code, or command to a protected computer, causing damage. The maximum penalty for this offense is up to one year in prison and a fine of up to $100,000. His sentencing is scheduled for November 17, 2026, before U.S. Magistrate Judge Michael J. Roemer.

cryptonews.ru08/14 19:58

Secretly Mined 1 BTC on Work Computers: Crypto Firm Employee Faces Prison

cryptonews.ru08/14 19:58

Mining Company Employee Mined 1 BTC on Employer's Equipment

In July 2021, an employee at a New York-based mining company, identified as Rankin, misused his access to 100 of his employer's computers. He redirected the corporate computing power to his personal mining pool and transferred the mined cryptocurrency to Bitcoin addresses under his control. His actions forced the equipment to operate at a high-performance level, significantly reducing its lifespan and damaging stored data. As a result, the company lost 1.06683386 BTC, valued at approximately $53,315 at the time of the crime. The U.S. Attorney's Office for the Western District of New York charged Rankin with transmitting malicious code and commands to protected computers, and with damaging property. He faces up to a year in prison and a fine of up to $100,000, with sentencing scheduled for November 17, 2026. The report also mentions a similar case in Russia, where a manager at a plant was suspected of illegally using electricity for mining over four years.

cryptonews.ru08/14 11:34

Mining Company Employee Mined 1 BTC on Employer's Equipment