Coldcard attacker moves 4,200 stolen Bitcoin to mixers

A third‑wave attacker who targeted Coldcard hardware wallets has moved 45 % of the Bitcoin it stole, according to an analysis from blockchain‑analytics firm Galaxy. The move was detected in mid‑March when Galaxy traced the coins from the original Coldcard addresses to new accounts that appear to be part of a laundering chain. The report says the attacker began shifting the funds shortly after the third wave of thefts was reported in early February.

Coldcard wallets are built for security, but recent attacks have exploited firmware bugs and social‑engineering tricks. The first two waves of thefts, which began in late 2023, left 82 % of the stolen coins in the original addresses and 18 % in other wallets. Those coins were largely untouched, making them easier to track. In the third wave, however, the attacker moved a much larger share of the loot, which raises concerns that the coins are being integrated into the market more quickly and with less traceability.

Galaxy’s data shows that the attacker moved about 4,200 BTC, worth roughly $170 million at current prices, into a set of addresses linked to a known mixing service. The transfer took place over a two‑week period and was followed by a series of smaller transactions that spread the coins across dozens of wallets. Exchanges that had listed the original addresses flagged the activity and froze the funds pending investigation. Regulators in the United States and the European Union have urged the industry to tighten monitoring of hardware‑wallet thefts.

Law‑enforcement agencies are now looking into the laundering network. The U.S. Department of Justice has requested additional information from the exchanges that froze the coins, while the European Union’s Financial Action Task Force is reviewing its AML guidelines. For Coldcard users, the incident underscores the need for firmware updates and the importance of keeping seed phrases offline. The broader crypto market will watch how quickly the stolen coins are liquidated, as that can affect price volatility and investor confidence.