{
  "note": "Curated ledger of known mass drains of bitcoin: key-generation failures, dormant-coin sweeps, and major exchange compromises. Maintained by hand. Live incidents detected by this service appear separately in incidents.json.",
  "events": [
    {
      "date": "2026-07-30",
      "name": "Coldcard Mk3/Mk4 RNG failure",
      "btc": 1082.65,
      "addresses": 1196,
      "duration_minutes": 41,
      "summary": "A 2021 firmware commit routed seed generation away from the STM32 hardware RNG, leaving ~72 bits of effective entropy. Attackers reproduced seeds from visible addresses/xpubs and swept ~500 wallets (594 BTC) in the first 25 minutes, ~1,196 addresses (1,082 BTC) within 41 minutes.",
      "references": [
        "https://www.coindesk.com/tech/2026/07/31/major-bitcoin-wallet-flaw-drains-594-btc-in-25-minute-sweep",
        "https://thehackernews.com/2026/08/coldcard-hardware-wallet-flaw-linked-to.html"
      ]
    },
    {
      "date": "2023-07-21",
      "name": "Milk Sad (Libbitcoin bx weak entropy)",
      "btc": 900,
      "addresses": 2600,
      "duration_minutes": null,
      "summary": "Libbitcoin Explorer's 'bx seed' used a 32-bit Mersenne Twister seeded with system time, making every wallet it generated brute-forceable. Coordinated thefts drained wallets in bulk starting 12 July 2023. Researchers later enumerated the full weak keyspace.",
      "references": [
        "https://milksad.info"
      ]
    },
    {
      "date": "2019-05-07",
      "name": "Binance hot wallet breach",
      "btc": 7074,
      "addresses": null,
      "duration_minutes": null,
      "summary": "Attackers combined phished credentials, API keys, and intercepted 2FA codes to pass Binance's withdrawal checks, pulling 7,074 BTC from the hot wallet in a single transaction. The exchange covered the loss from its emergency insurance fund.",
      "references": []
    },
    {
      "date": "2017-12-06",
      "name": "NiceHash payment system breach",
      "btc": 4736,
      "addresses": null,
      "duration_minutes": null,
      "summary": "A compromised employee credential gave attackers access to the mining marketplace's payment system. The entire hot wallet, about 4,700 BTC of miner balances, was withdrawn in a single sweep.",
      "references": []
    },
    {
      "date": "2016-08-02",
      "name": "Bitfinex multisig drain",
      "btc": 119756,
      "addresses": null,
      "duration_minutes": null,
      "summary": "Attackers defeated the exchange's BitGo-backed multisignature withdrawal controls and drained 119,756 BTC across roughly 2,000 transactions. The coins then sat dormant for years. US authorities seized the bulk of them in 2022 when the launderers were arrested.",
      "references": [
        "https://en.wikipedia.org/wiki/2016_Bitfinex_hack"
      ]
    },
    {
      "date": "2015-11-01",
      "name": "Brainwallet mass drains",
      "btc": null,
      "addresses": 884,
      "duration_minutes": null,
      "summary": "Keys derived from human-chosen passphrases (brainwallet.org and similar) were continuously cracked and swept by bots. Research documented hundreds of drains, most within minutes of funding.",
      "references": [
        "https://eprint.iacr.org/2016/103"
      ]
    },
    {
      "date": "2015-01-04",
      "name": "Bitstamp hot wallet compromise",
      "btc": 18866,
      "addresses": null,
      "duration_minutes": null,
      "summary": "A spear-phished employee workstation exposed the exchange's hot wallet keys. 18,866 BTC left over two days before Bitstamp froze operations and rebuilt on fresh cold storage.",
      "references": []
    },
    {
      "date": "2014-12-08",
      "name": "Blockchain.info entropy failures",
      "btc": 267,
      "addresses": null,
      "duration_minutes": null,
      "summary": "The blockchain.info web wallet suffered repeated client-side randomness flaws between 2012 and 2014. Reused ECDSA nonces let observers recover private keys directly from the chain, and a December 2014 RNG regression generated predictable keys for hours. A white-hat researcher swept roughly 267 BTC from the exposed addresses and returned the funds.",
      "references": [
        "https://eprint.iacr.org/2013/734"
      ]
    },
    {
      "date": "2014-02-24",
      "name": "Mt. Gox collapse",
      "btc": 850000,
      "addresses": null,
      "duration_minutes": null,
      "summary": "Bitcoin's largest exchange halted withdrawals and filed for bankruptcy after admitting roughly 850,000 BTC of customer and company coins were missing, siphoned through years of unnoticed hot wallet key compromise. About 200,000 BTC were later found in an old wallet. Movements of the remaining Gox-era coins still ripple through dormancy monitors today.",
      "references": [
        "https://en.wikipedia.org/wiki/Mt._Gox"
      ]
    },
    {
      "date": "2013-08-11",
      "name": "Android SecureRandom flaw",
      "btc": 55,
      "addresses": null,
      "duration_minutes": null,
      "summary": "Android's Java SecureRandom could repeat ECDSA nonces, exposing private keys of wallets that signed transactions on affected devices. Multiple wallets were swept before mass key rotation.",
      "references": [
        "https://bitcoin.org/en/alert/2013-08-11-android"
      ]
    },
    {
      "date": "2012-09-03",
      "name": "Bitfloor backup key theft",
      "btc": 24000,
      "addresses": null,
      "duration_minutes": null,
      "summary": "An attacker reached unencrypted wallet backup keys left accessible during a server migration and drained 24,000 BTC. The exchange could not cover the loss and shut down the following year.",
      "references": []
    },
    {
      "date": "2012-03-01",
      "name": "Linode breach (Bitcoinica and others)",
      "btc": 43554,
      "addresses": null,
      "duration_minutes": null,
      "summary": "Attackers compromised the Linode cloud host and emptied the hot wallets of eight customers in one night, including Bitcoinica and the Bitcoin Faucet, taking 43,554 BTC. A second breach at Bitcoinica that May took another 18,547 BTC and finished the exchange.",
      "references": []
    }
  ]
}