An attacker linked to a third wave of thefts targeting Coldcard hardware wallet users has begun shifting a significant portion of the stolen Bitcoin, according to research from Galaxy Digital, raising fresh concerns about laundering activity tied to the campaign.
Attacker Begins Moving Funds
Galaxy Digital reported that the perpetrator behind the most recent Coldcard-related attack has moved roughly 45% of the Bitcoin stolen in that particular wave. The movement of funds is often an early indicator that a thief is attempting to obscure the trail of illicit proceeds before cashing out or funneling the assets through mixing services.
The activity marks a notable shift from earlier phases of the broader Coldcard attack campaign, where the vast majority of stolen coins had remained dormant in the addresses to which they were originally sent.
Once stolen crypto starts moving, the clock begins ticking on any chance of recovery.
Most Stolen Bitcoin Still Sitting Still
Across all of the Coldcard-related attacks combined, Galaxy found that the picture remains largely static. According to the firm's analysis, about 82% of the total Bitcoin stolen across every wave of the campaign still sits in its original addresses, untouched by the attackers.
The remaining 18% has been moved in what analysts describe as apparent laundering activity. That figure suggests that while attackers have started to test the waters with some of the funds, the bulk of the haul has yet to be relocated or converted.
Key findings from Galaxy's research include:
- Roughly 82% of all stolen Coldcard Bitcoin remains in original wallet addresses
- About 18% has been moved in what appears to be laundering attempts
- The third-wave attacker has shifted around 45% of that wave's proceeds
What It Means for Coldcard Users
The staggered movement of funds gives investigators and blockchain analytics firms a window to trace transactions and potentially flag associated addresses across exchanges. Coins that remain stationary are easier to monitor, but funds that begin flowing through mixers or intermediary wallets become progressively harder to follow.
For holders of hardware wallets, the incident underscores the ongoing risk of targeted attacks against even self-custody solutions that are generally regarded as among the more secure options available. As attackers grow more sophisticated, security researchers continue to urge users to remain vigilant about the integr