Missed this, apologies!

Public APIs often have max-per-page forced pagination to reduce load on their infra, whereas private infra like the bitcoind RPC often don't implement a hard max and even do not set an initial default.

Thus, when you see a low artificial limit in an attack, like 200 utxo max which is significantly under the max tx size, especially for p2wpkh, but also for old school p2pkh, it is extremely likely that a service was used and not sovereign infra. And that is the kind of lead that can break an investigation from hopeless into catching a lazy attacker if you'd be, say, representing a victim.

I'm glad that Block found the same and chased it down.

During our investigation of the Coldcard drain yesterday, we identified an unusual pattern in the sweeps. That pattern led us to a hypothesis that has since been confirmed: the operator used a paid account at a well-known blockchain-services provider to query the source addresses and perform other related activity during the sweeps.

We contacted the provider directly. Their internal logs matched the suspected workflow with extraordinary specificity, including the number, timing and sequence of requests. The provider was supplying its standard services in response to requests that did not reveal their broader purpose. We have seen no evidence that the provider knowingly participated in or facilitated the suspected theft.

We are sharing the relevant information with the appropriate authorities. We will provide further updates when doing so will not interfere with the investigation.

https://nitter.net/clay_garrett/status/2083247006139503065