Open Source Repo

https://github.com/VirtusVerbis/BTC_Bloodhound

Contact

• YouTube
• Rumble
• Fountain
• X (@VirtusVerbis)

Purpose

Bitcoin Bloodhound maps consolidation addresses, victim inputs, and downstream flows from the 2026 Coldcard entropy exploit. It is an exploratory on-chain visualization tool, not a forensic or legal record.

Keyboard commands

• [ — Zoom out the graph.
• ] — Zoom in the graph.
• Page Up — Select the previous hacker in the dropdown (stops at the top entry).
• Page Down — Select the next hacker in the dropdown (stops at the bottom entry).

Hack coverage

• Coinkite — Coldcard Security Advisory
• Coinkite — Technical Deep Dive into the Entropy Issue
• Rob Hamilton (X) — Urgent security advisory
• Chainalysis (X) — Coldcard hack analysis
• Calle (X) — Bitcoin Red Team post-incident security work
• Block Engineering — Predictable RNG fallback analysis
• Wizardsardine — Coldcard: the technical autopsy of an entropy failure
• Praveen Perera (X) — Inside Wave 1: tracing the Coldcard drain
• Praveen Perera — Inside Wave 1: tracing the attacker’s steps through the Coldcard drain
• James O'Beirne — CKTRIPWIRE honeypot scoreboard

Monitoring

A background indexer continuously polls blockchain APIs and public tracker sites. The header Monitoring indicator shows when activity was last observed — the most recent of a successful chain API response, an external tracker sync, or a completed indexer job.

Actively polled external tracker sites:

• coldcard-watch.vercel.app — Coldcard Sweep Watch
• coldcard-hack-tracker.vercel.app — Coldcard Hack Tracker
• coldcardwatch.com — coldcardwatch.com

Data sources

• coldcardwatch.com — Collector and victim address lists synced periodically.
• Coldcard Sweep Watch — Wave 3 vault addresses and collector (“where the money is”) addresses synced periodically.
• Coldcard Hack Tracker — Watched holding/collector addresses from snapshot.json synced periodically.
• dsbaars gist — public hacker address seed list — Initial consolidation addresses loaded at indexer seed time.

The background indexer actively sources coldcardwatch.com, coldcard-watch.vercel.app, and coldcard-hack-tracker.vercel.app on a cron schedule. Additional victim and downstream addresses are inferred on-chain using blockchain API data.

APIs used

• Blockstream Esplora — https://blockstream.info/api · API docs
• Mempool Space — https://mempool.space/api · API docs