Coldcard Hacker Moves $7.7M, Nearly Half of Third-Wave Bitcoin Haul

The Coldcard hardware wallet exploit continues to unfold as the attacker behind the third wave of thefts has transferred nearly half of that wave's stolen Bitcoin through privacy-mixing techniques. According to Galaxy Research, 97.09 BTC left the victim vaults on September 2 and over the weekend, with the first batch routed through THORChain to Ethereum while subsequent transactions entered CoinJoin rounds—a privacy protocol that obscures transaction trails by pooling multiple users' transactions together.

The attacker's methodology reveals a calculated approach to laundering the stolen cryptocurrency. Rather than emptying all vaults simultaneously, the perpetrator created 293 separate two-of-two multisig vaults and has been systematically draining them from largest to smallest. To date, eleven vaults have been completely emptied, with the next ten containing 30.81 BTC and the remaining 233 holding 33.77 BTC combined. This measured approach contrasts sharply with the vulnerability that enabled the thefts in the first place.

The exploits trace back to a critical firmware flaw that Coinkite, Coldcard's manufacturer, shipped in March 2021. The bug redirected seed generation from the device's secure hardware random-number generator to a software substitute, reducing cryptographic entropy from 128 bits to as little as 40 bits. This catastrophic weakness allowed attackers to reconstruct private keys offline and drain single-signature addresses without ever physically accessing the hardware wallets. The thefts began on July 30 and have continued in multiple waves.

Coinkite has released updated firmware requiring users to manually provide randomness through key presses, dice rolls, or coin flips, but the remedy cannot restore seeds generated under the flawed version. Users must generate entirely new seeds and manually transfer their coins to fresh wallets. The company's CEO issued an apology on July 31, acknowledging the need to rebuild user trust, though a comprehensive technical postmortem remains pending. Across all known waves of the exploit, approximately 82% of the stolen Bitcoin has not yet moved, suggesting the attacker may be holding the remainder or planning future movements.