Coldcard Exploiter Moves 45% of Funds Stolen in Latest Attack Wave

The attacker behind the Coldcard hardware wallet exploits has moved nearly half of the Bitcoin stolen in the third wave of attacks, according to Galaxy Research.

Galaxy said the Wave 3 exploiter continues to move stolen Bitcoin after previously swapping some of the funds into Ether through THORChain on September 2. On Sunday, the attacker began routing the Bitcoin through CoinJoin transactions, a technique that can make transaction trails harder to follow.

So far, 97.09 BTC worth about $7.8 million has been spent from the Wave 3 funds.

Coldcard Attacker Moves Funds in Order

Galaxy said the exploiter has been moving the stolen Bitcoin according to the size of each victim vault, starting with the largest holdings.

Ranks 1 through 11 have already been moved. The next 10 untouched vaults contain 30.81 BTC, while smaller vaults ranked 61 through 293 hold another 33.77 BTC combined.

Across all Coldcard-related thefts, Galaxy estimates that about 82% of the stolen funds remain in addresses controlled by the attacker. The remaining 18% has already been moved through various routes as the exploiter attempts to launder the assets.

The latest movements add another layer to an attack that has already become one of the year's largest crypto security incidents.

Coldcard Exploit Traced to Old Firmware Bug

The attacks began on July 30 and were linked to a firmware vulnerability introduced by Coinkite in 2021.

The bug affected how Coldcard devices generated wallet seeds, reducing the randomness available during the process. That weakness potentially allowed attackers to brute-force seed phrases associated with affected single-signature wallets and move their Bitcoin without physically accessing the hardware devices.

By mid-August, Galaxy had identified approximately 1,779 BTC stolen from 190 victims across more than 8,600 addresses.

Galaxy has also warned that another wave of attacks could emerge, although a potential Wave 4 has not been confirmed.

Coldcard Losses Could Be Even Larger

Galaxy's latest investigation uncovered another previously unidentified group of addresses.

The research firm said the exploiter “co-spent” a previously unknown vault containing 58 addresses believed to belong to Coldcard victims.

Including those addresses would raise the estimated total stolen to approximately 1,806 BTC, worth about $143.9 million at current prices.

The discovery shows that the full scale of the Coldcard incident may still be evolving as researchers track the attacker's movements and identify additional affected wallets.

The latest fund transfers also make monitoring increasingly important. While most of the stolen Bitcoin remains in attacker-controlled addresses, the movement of larger vaults through swaps and CoinJoin transactions could make recovery and attribution more difficult.

The Coldcard incident follows a broader rise in crypto security breaches, reinforcing a point highlighted in our recent “Crypto Hacks Skyrocket in August: 50 Cases, $136 Million Stolen” article: a lower monthly dollar loss does not necessarily mean crypto security is improving. The number of major incidents increased sharply in August even as total stolen funds fell.

For Coldcard users and the wider Bitcoin ecosystem, the immediate focus remains on identifying affected wallets, tracking the remaining funds and determining whether another wave of attacks emerges.