An attacker who exploited Coldcard hardware wallets has begun moving stolen Bitcoin worth roughly $7.7 million, representing nearly half of the funds taken in the latest wave of thefts, according to blockchain observers tracking the wallets.
How the Funds Are Being Moved
The perpetrator reportedly split the stolen Bitcoin across 293 separate vaults, a structure that fragments the funds and complicates efforts to trace and freeze them. Rather than moving everything at once, the hacker has adopted a methodical approach, draining the vaults one at a time.
The pattern shows the attacker emptying wallets in descending order of value, starting with the largest holdings before working through smaller amounts. This deliberate sequencing suggests an organized effort to liquidate or launder the biggest sums first while activity draws attention.
The thief is cashing out the fattest wallets first, working down the pile one vault at a time.
The movement of $7.7 million accounts for close to half of the Bitcoin gathered in what has been described as the third wave of thefts tied to compromised Coldcard devices.
Concerns for Hardware Wallet Users
Coldcard is a hardware wallet designed to keep private keys offline, a setup generally regarded as one of the more secure ways to store Bitcoin. Incidents involving compromised units raise questions about how attackers gained access and whether users may have fallen victim to tampered devices or social engineering.
Blockchain analysts continue to monitor the wallets as the funds move, hoping to flag transactions to exchanges and services that could intervene. However, the fragmented vault structure gives the attacker room to maneuver and slows any coordinated response.
For users of self-custody hardware, the episode underscores the importance of verifying device authenticity and remaining cautious about the source of any wallet:
- Purchase hardware wallets only from official or trusted vendors.
- Confirm device integrity before transferring significant funds.
- Watch for phishing attempts and tampered packaging.
As the situation develops, the remaining stolen Bitcoin held across the vaults will likely continue to draw scrutiny from investigators and the broader crypto community.