More than 4,585 $BTC wallet owners are victims of Coinkite’s firmware bug and its compromised Coldcard hardware wallets, including devices with and without passphrases.

At time of writing, no one has publicly confirmed the identity(ies) of the hacker(s).

If you’re a victim, it is important to take immediate action to protect any remaining funds and document your loss for legal and criminal procedures.

The flaw traces to faulty firmware (on-device software) on Coldcards from March 2021 through late last week. Thousands of customers bought and trusted the devices to secure untold sums of money.

Founder Rodolfo Novak, known as “NVK,” apologized on social media, saying, “I’m sorry and I’m devastated,” pledging Coinkite is “committed to working with affected users who want to pursue a police report, insurance claim, or their own investigation.”

Coldcard victims should report to law enforcement

US residents can always call their local police department to file a complaint. Formal local police reports are important for many reasons, since a report often precedes insurance claims or civil suits.

Although police departments vary in crypto expertise by location, anybody making a complaint will need to provide any evidence that a police officer requests, such as transaction IDs, the drained addresses, balance screenshots, receipts, or a written timeline.

When filing the report, ask the police officer whether you should also file a complaint with the FBI, or whether they will submit one on your behalf.

The FBI’s Internet Crime Complaint Center, IC3, is the primary federal intake point for crypto theft. Victims of the Coldcard hack may access https://complaint.ic3.gov and submit their documentation.

Victims over the age of 60 who have visual difficulty accessing this website can also call the FBI’s Elder Fraud Hotline at (833) 372-8311.

Again, residents of any municipality may ask for assistance from their local police officer.

Beware fake ‘law enforcement’ inquiries

IC3 states it “does not work with any non-law enforcement entity, such as law firms or crypto services, to recuperate lost funds,” and warns it “will never directly contact victims for information or money.”

Don’t trust any unsolicited inbound call, text, email, or other message from someone claiming to work for the FBI or IC3. Victims should initiate a report themselves, not respond to an unsolicited inquiry from someone who might be faking credentials.

After submitting these police and FBI report(s), sophisticated victims may consult their attorney as to the suitability of their loss for filing a fraud report at https://reportfraud.ftc.gov regarding Coinkite’s advertising or business practices.

Victims should also consult their tax professional or attorney regarding the suitability of documenting or timestamping evidence of their loss for IRS tax forms.

Protos doesn’t offer legal or tax advice. Please consult a licensed professional for personalized legal advice that suits your individual situation.

Coldcard attack: 25 minutes, 500 wallets, $38M in $BTC gone
$BTC gone” — Protos" src="https://protos.com/coldcard-attack-25-minutes-500-wallets-38m-in-btc-gone/embed/#?secret=2PYGHyOUM3#?secret=fmvA0M3I1T" frameborder="0" marginwidth="0" marginheight="0" scrolling="no">

Considerations for civil legal actions

Outside of the criminal legal system, victims may consider civil claims against Coinkite.

The most important consideration regarding lawsuits, including class action suits, is to ensure that your attorney is licensed, reputable, and in good standing with their state’s bar association.

Lawyers are licensed by a state agency, not on a federal level. The American Bar Association has links to all 50 states here so that you can check the license status of your attorney.

Don’t trust unsolicited messages from phone calls, text, direct messages, emails, or other methods of contact. Independently verify the license status and contact information of an attorney through a state bar association.

AI websites, official-looking credentials, and social media clout can mislead victims into revealing personal information to scammers pretending to be attorneys. Be careful to call an attorney on a phone number registered with their state bar association.

The FBI has already issued a public service announcement about fictitious law firms targeting crypto scam victims.

Coinkite Inc. is a small, Toronto-based private company, according to the Better Business Bureau. Co-founders Rodolfo Novak and Peter Gray built it as a self-funded hardware maker.