Thorn said the funds apparently left the casino before it could freeze them, although Duel "do have ID of the depositor" and "should be able to ID this one attacker" once the victim's police report arrives.
The Coldcard drama shows no signs of slowing down days after the vulnerability was first disclosed. Blockchain sleuths and investigators are now racing to trace more than $80 million in stolen Bitcoin across the industry.
Some are already turning up leads. Alex Thorn, Galaxy Digital's head of firmwide research, said in an X post that on-chain tracing suggests some of the Bitcoin stolen from Coldcard wallets may have reached Duel, an online crypto casino known on social media for its chaotic live streams and bizarre, meme-worthy dealer personalities.
"Outrageous response"
As Thorn explained, the victim lost nearly 30 BTC and "had 17 BTC peeled" from the stolen funds. The bitcoin was exchanged through THORChain, a decentralized cross-chain liquidity protocol, for ETH and subsequently deposited into Duel, he said.
Both the victim and a researcher "emailed all known addresses for Duel and asked for freeze" and "provided all info on the txs and deposits," according to Thorn.
Duel's response "was for him to have the police contact them, despite the fact that their AML policies claim they perform KYC and adhere to all relevant laws," he added, referring to AML rules and KYC checks.
Alex Thorn
A few hours after the post went viral, an X account posting as Korra and identifying itself as part of Duel's team said the casino would not freeze a customer's balance solely on another person's allegation.
Korra
The operator nevertheless offered Coldcard victims a one-time exception. Korra said anyone seeking a temporary freeze without a police report or court order must "sign a message from an address of the 'hack,' sign an affidavit stating they were hacked, and show the clear trail of evidence leading to Duel."
The casino then "will temporarily freeze the funds without a police or court order," Korra added.
Korra's replies indicate that users cited Chainalysis, a blockchain-forensics company, in support of the alleged connection.
- However, no Chainalysis report, Bitcoin address, transaction ID or deposit amount was included in the comments reviewed by The Coinformer.
One private key, two possible signers
A valid Bitcoin message signature demonstrates that the signer can use the private key associated with an address.
- If the address belonged to a victim whose weak Coldcard seed was reconstructed, both the victim and the alleged hackers could possess the same private key and produce valid signatures.
- A signature would therefore support the claimant's connection to the wallet, but wouldn't conclusively distinguish the original owner from whoever reconstructed the key.
Korra didn't specify which signing format Duel would accept.
However, BIP-322, Bitcoin's generic signed-message standard, cautions that no message-signing protocol can prove control of funds or establish that a signer sent an earlier transaction.
Duel would therefore have to evaluate the signature alongside the affidavit, transaction history and any additional evidence.
- As The Coinformer reported earlier, affected Coldcard firmware generated recovery seeds with substantially less randomness than intended.
- The company advised affected owners to create new seeds and move their bitcoin.
Galaxy Research estimated that three suspected theft waves drained over 1,367 BTC, worth about $88 million at the time, from more than 4,580 addresses.