Aha, so basically attacker "revealed" himself by consolidating...?

where funds were swept to. Number is a minimum floor estimate. Likely more 

![](https://m.stacker.news/150462)

https://coldcard-watch.vercel.app/methodology.html

HardMoney

I think the attacker is just grinding out low entropy deterministic seeds from the bad RNG but and then scanning to see if there are any funds there

Yes, that much I gather. How do we know which transactions are that? (Such that we can arrive at the number 1131 BTC or whatever and show them publicly?)

bitcoin

Coldcard Sweep Watch

> I think the attacker is just grinding out low entropy deterministic seeds from the bad RNG but and then scanning to see if there are any funds there 

Yes, that much I gather. How do we know which transactions are that? (Such that we can arrive at the number 1131 BTC or whatever and show them publicly?)