An Open Letter to the COLDCARD Hacker
The COLDCARD attacker has already exposed one of Bitcoin’s gravest hardware-wallet failures. Further theft proves nothing. Returning the funds would preserve the disclosure, protect thousands of victims and give this event a radically different meaning.
To the person or group responsible for the COLDCARD drains
The bitcoin you control came from thousands of individual holders. Many of them followed the security practices the industry had recommended. Some lost savings accumulated over years. Their losses cannot reasonably be treated as a penalty for Coinkite’s conduct, because they neither wrote the firmware nor reviewed its code.
The funds may be under your control, yet their history is permanently public. Every consolidation, transfer, bridge, exchange deposit and eventual conversion into fiat or regulated assets creates additional opportunities for attribution.
The practical value of the stolen bitcoin will therefore remain substantially lower than its nominal value, while the legal and personal risk attached to spending it will persist for decades.
You now possess an unusual degree of control over the meaning of this event. Keeping the funds will define it as a large and methodical theft. Returning them will turn it into one of the most consequential acts of security disclosure in Bitcoin’s history and will force the industry to confront the failure without leaving thousands of users to bear its entire cost.
A credible return process can protect all parties. An independent group of respected Bitcoin developers, security researchers and victim representatives should publish verified return addresses, document every transaction and establish a transparent procedure for distributing recovered funds. A limited and publicly agreed bounty can be reserved in recognition of the vulnerability’s discovery. Coinkite should have no unilateral control over that process.
You have already shown what you were capable of finding. You can now decide what you are willing to do with that capability.
Return the funds.
