If you believe your Bitcoin was stolen because of the
@COLDCARDwallet vulnerability, report it to law enforcement as soon as possible.
Do not assume your case is too small, too technical, or too late to report.
Start with your local police department. Ask to file an official report and request that it be routed to a detective who handles cybercrime, financial crimes, or cryptocurrency investigations.
If you are in the United States, also submit a complaint through the FBI’s Internet Crime Complaint Center at
IC3.gov. You can contact your local FBI field office as well.
Before making the report, collect what you have:
• The wallet address from which the Bitcoin was stolen
• The destination address or addresses
• Transaction hashes
• The amount taken
• The date and time of the transactions
• Your COLDCARD model
• The firmware version used when the seed was generated
• The approximate date the seed was created
• Purchase records, screenshots, emails, or other supporting information
• Any report or complaint numbers you have already received
Preserve the device, seed backup, packaging, receipts, and related records. Do not destroy or reset anything that could later help establish ownership or support the investigation.
Most importantly, do not share your seed phrase, private keys, PIN, or sensitive personal information with anyone offering to recover your funds.
Victims of cryptocurrency theft are frequently targeted a second time by people pretending to be investigators, attorneys, recovery specialists, or government officials.
What we can do is help victims understand how to report the theft and help participating law enforcement agencies identify related investigations and reach the appropriate investigators.
If you were affected and do not know where to begin, send Deconflict a DM.
Do not include your seed phrase, private keys, PIN, Social Security number, identification documents, or other sensitive information.
We will help point you toward the appropriate law enforcement reporting channel.