So who is behind the Coldcard exploit? Who is stealing all that Bitcoin?
I put the question to Casa (nprofile…mcxe) CTO Jameson Lopp (nprofile…xxx2) - who says it could prove incredibly difficult to pinpoint the perpetrators.
DPRK hackers?
npub1dd…mtltz
2026-08-04 10:13:28 UTC
Author Public Key
npub1ddl5yus2rlmcd0ax4ve68fdneufj5xhsrgfrpdm74ryltt3nnsfqhmtltzSeen on
wss://nos.lolPublished at
2026-08-04 10:13:28 UTCEvent JSON
{
"id": "99a685945df6d157c5150b3562fad1790710a3470cd862b86f2e4b507a36a5a5",
"pubkey": "6b7f42720a1ff786bfa6ab33a3a5b3cf132a1af01a1230b77ea8c9f5ae339c12",
"created_at": 1785838408,
"kind": 1,
"tags": [
[
"p",
"f728d9e6e7048358e70930f5ca64b097770d989ccd86854fe618eda9c8a38106",
"wss://nostr.lopp.social/",
"mention"
],
[
"p",
"c761dc761dbe60d1879a9852bba96fee63eeab0d73911c55365c5ecf204949a2",
"wss://nostr.mom",
"mention"
],
[
"imeta",
"url https://blossom.primal.net/0a3390815df8198486beab1c723c7930ca9241ee20c432af794834569e6426c3.mp4",
"m video/mp4",
"dim 1920.0x1080.0"
],
[
"client",
"Primal iOS"
]
],
"content": "So who is behind the Coldcard exploit? Who is stealing all that Bitcoin?\n\nI put the question to nostr:nprofile1qqsvwcwuwcwmucx3s7dfs54m49h7uclw4vxh8ygu25m9chk0ypy5ngsppamhxue69uhkummnw3ezumt0d5q3gamnwvaz7tmjv4kxz7fwdehhxarj9e3xwhqmcxe CTO nostr:nprofile1qqs0w2xeumnsfq6cuuynpaw2vjcfwacdnzwvmp59flnp3mdfez3czpsprpmhxue69uhkummnw3ezumr0wpczuum0vd5kzmp0ksxxx2 - who says it could prove incredibly difficult to pinpoint the perpetrators.\n\nDPRK hackers?\nhttps://blossom.primal.net/0a3390815df8198486beab1c723c7930ca9241ee20c432af794834569e6426c3.mp4",
"sig": "17161d3094b1edc3265f1a56fa999bcff4b308006faba9ba5583f04206f09ce63980f451ef309807559df0f0c69008bd84ceb7bdeb39d2680f893983592a4b20"
}