The attacker behind a series of Coldcard hardware wallet thefts has moved roughly $7.7 million worth of bitcoin, draining nearly half of the funds stolen in the latest wave of attacks, according to research from Galaxy.
The Latest Movement of Stolen Funds
Blockchain analysts at Galaxy Research reported that the hacker has now emptied the 11 largest vaults connected to the third wave of Coldcard-related thefts. The transfers account for about 45% of the bitcoin taken during this most recent round of attacks, signaling a coordinated effort to consolidate and possibly launder the illicit gains.
The movement of such a substantial sum highlights the ongoing risk facing holders of hardware wallets, devices typically marketed as one of the most secure ways to store cryptocurrency offline.
The attacker has systematically targeted the largest vaults first, extracting maximum value with each strike.
A Pattern of Repeated Attacks
This marks the third distinct wave of thefts tied to Coldcard devices, suggesting the attacker has developed a repeatable method for compromising affected wallets. Each successive wave has demonstrated increasing sophistication in identifying and draining high-value targets.
Security researchers continue to monitor the flow of stolen bitcoin as the attacker moves funds across the blockchain. Such tracking is often a precursor to identifying exchanges or mixing services where the perpetrator may attempt to cash out.
Key details from the ongoing investigation include:
- Approximately $7.7 million in bitcoin has been moved
- The 11 largest vaults in the third wave have been drained
- Roughly 45% of stolen funds from this wave are now in the attacker's control
What It Means for Wallet Holders
The incident serves as a stark reminder that even hardware wallets, long considered a gold standard for self-custody, are not immune to compromise. Users are urged to verify the authenticity and integrity of their devices and to remain vigilant about the source of their hardware.
As investigators trace the movement of the funds, the broader crypto community will be watching closely to see whether any of the stolen bitcoin can be recovered or whether the attacker successfully evades detection.