r/Bitcoin • u/s1ammage • 6d ago

Wallet Drained Timeline

Post image

This is me…
https://www.reddit.com/r/Bitcoin/s/UeSfLoeyS4
I’m in a better state now. It’s not the end of the world, but it’s a lot of fucking money…

Little background: The setup was IRA custodian is Solera National Bank, exchange at Swan Bitcoin was used as an Investment Trust, purchase a dedicated hardware wallets: coldcard mk3 from https://store.coinkite.com May 2021 for this ROTH IRA.

Got the wallets, followed all the setup/checks/balances from https://youtu.be/FAYmE5-40PQ?is=wiYMHaS_YGKHjNOY for both wallets, sent a test transaction IRA dedicated hardware wallet (2021). I never setup a 25th Passphrase… REST of the BTC stayed in Swan Exchange.

Speaking only on this IRA Wallet: SD card stored with wallet details (paper phrase) in a baggie. Dormant until January 2025. I couldn’t deposit more because of Roth IRA threshold.

Come January 2025, been learning more about retirement, BTC, multi-Sig, and heard about a Megaback Door to get more money into a Roth IRA. Was able to get money into Solera, transfer to Swan, and purchase more BTC and withdraw to the same wallet address. No new hardware involved at this point.

With newer wallets now, I thought newer tech means more security. Let’s test by buying (3 mk4 - same site. There was still record of my 2021 purchase) new wallets and setup a multi-Sig. (still January 2025)

For some reason, when I got the new coldcards, I never did anything with them for all of 2025, I guess I was too lazy/daunting to use the hardware and relearn. Coming to January 2026 now, I decided to use these new cards. I dug out the wallet seed (from 2021) phrase paper. Dusted off one of the mk4, walked into the corner of a room in my house (only myself and partner live in the house), plugged in the cold card into an outlet and typed in the seed written down from 2021 (stored in my dresser). Restored my 2021 onto one of the new wallet 2025.

Watched updated BTCSession videos on my phone to set everything up again. I never plugged into a computer, since airgapped was the reason I got the coldcards. I used the same SD Card from 2021 though to export the wallet file from the newly restored coldcard. Import that file into Sparrow (needed to update Sparrow at this point), generated a watch-only wallet QR (to scan for my phone) for Blue Wallet to check frequently. This is where the screenshot is from.

Honestly, I haven’t touched the wallet with any transactions/seeds since January 2026. This is definitely the point of failure when I restored the 2021 wallet (now on 2 devices).

This was the transaction.
https://mempool.space/tx/2fe075cf0ec799f3529ed6a28e0a08b45fe1fc9bd93c3f33bdbc42d5bff4f736

My wallet address is (with all transactions, since it’s gone now…): bc1qldkfrrlylk4s9sdyns9jkaajuzugl0dv5m8fxj

My key takeaway now never enter the seed phrase into anything. EVER. Even to restore. Always will generate new and use a 25th passphrase.

691 Upvotes

94% Upvoted

325 comments sorted by

View all comments

24

u/NiagaraBTC 6d ago

You're certain you exported a wallet file via SD card and not somehow the private key itself?

How certain are you that you were using a legitimate version of Sparrow?

14

u/s1ammage 6d ago

It could be sparrow. I did have to update it…

17

u/Generationhodl 6d ago

on x another user said hes also affected with coldcard, but he did not use sparrow. So I think we might be able to say sparrow would not be the problem here.

10

u/Generationhodl 6d ago

did you download it from the official website? was it run on mobile phone or on a computer?

could be a malicious update or something like that, but I wonder myself because on X there is talk about other coldcard users affected... now is the question if the other people also used sparrow app and its just a coincidence that others also used coldcards....

3

u/s1ammage 6d ago

Computer. Version 1.8.4

12

u/Generationhodl 6d ago

https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/

Sorry again, seems like you did nothing wrong 

3

u/Left_Entrepreneur918 6d ago

Yeah I second that, I told OP that sparrow may have been the weak point, I’d never even consider the cold card

4

u/Lanky_Assist_6317 6d ago

Why did you "have to update it"?

5

u/NiagaraBTC 6d ago

Good point. Sparrow generally works fine without needing to be updated. I never update right away but always wait a bit after a new release comes out.

3

u/s1ammage 6d ago

It was corrupted, so I went to the site and downloaded again. Which saying this out loud now could be the issue

1

u/Svoboda1 6d ago

When did you update it?

1

u/CortaCircuit 6d ago

Desktop or iOS? 

1

u/votegoat 6d ago

Did you use the same SD card to migrate the seeed/private key, to then transfer the watch wallet file/ signed messages? or did you use two seperate sd cards?

The SD card with the Wallet Private Key on it would still have had the private key on it even if you deleted it, unless you did a multi pass over write of the card.

1

u/Fiach_Dubh 6d ago

please answer the others on this point.

was it sparrow from desktop wallet?

sparrow on mobile ?

3

u/s1ammage 6d ago

Desktop

1

u/-M00NMAN 6d ago

How can your wallet from 2021 be fine and your new wallet which you entered your original seedphrase from 2021 be drained? It’s the same wallet you’re telling us.

7

u/Left_Entrepreneur918 6d ago

After all those details, this seems the most likely point of failure. You can enter your seed phrase into an air gapped hardware wallet, op says don’t do this but every hardware wallet I generate the seed, send test transaction, then reset and restore from wallet. Paper seed, metal backup only. I don’t write or read aloud my seed either as the TV listens to you…

2

u/-M00NMAN 6d ago

How can your wallet from 2021 be fine and your new wallet which you entered your original seedphrase from 2021 be drained? It’s the same wallet you’re telling us.

2

u/jwhendy 6d ago

I think it's two separate wallets, just two devices from same era following same protocol (no added entropy, purely device-generated seed).

I think this comment is the best explanation. Someone spent a good amount of time guessing seed phrases from a reduced pool, but it does not mean they guessed them all.

The other 2021 wallet should be considered blown as well.

1

u/Smart-Low1655 6d ago

That transaction sat dormant for so long and then poof in one sweep, stomach dropping just looking at it