Coldcard Exploiter Moves 45% of Wave 3 Loot as Stolen Bitcoin Enters CoinJoins
Across all attack waves, 82% of stolen coins remain in attacker-controlled addresses, while 18% have been moved for laundering.
Coldcard
Product · 238 articlesAll coverage
page 1 of 12
Coldcard ‘Wave 3’ attacker moves Bitcoin again: ‘Moved apparently for laundering purposes’
Is the Coldcard exploit slowly and steadily turning into a large-scale Bitcoin laundering operation?
AMBCrypto•Ishika Kumari7 Sept
Coldcard Hacker Moves 45% of Stolen Bitcoin Through THORChain
The perpetrator of the third wave attack against the Coldcard wallet has escalated the pace of transferring funds, reports Galaxy Research. The exploiters have transferred approximately 45% of the Bitcoin stolen from the third wave so far. These transfers indicate a pattern of using methods that make blockchain tracking difficult.
TheNewsCrypto•Lakshya Baskar7 Sept
Coldcard Hacker Moves $7.7M, Nearly Half of Third-Wave Bitcoin Haul
The attacker built 293 separate vaults for the stolen Bitcoin and is emptying them in order of size, largest first.
Coldcard attacker moves 45% of stolen Bitcoin through THORChain and CoinJoin, Galaxy reports
The incident highlights vulnerabilities in crypto security, emphasizing the need for robust safeguards and collaboration to prevent future breaches.
CryptoBriefing•Editorial Team7 Sept
Coldcard third-wave attacker moves 45% of stolen Bitcoin
Galaxy said 82% of Bitcoin stolen across all Coldcard attacks remains in the original addresses, with 18% moved in apparent laundering.
Cointelegraph•Cointelegraph by Zoltan Vardai7 Sept
Coldcard hacker moves $7.7 million in BTC, 45% of bitcoin stolen in third attack wave
CoinDesk•AI Boost7 Sept
Coldcard exploiter moves 45% of funds stolen from ‘Wave 3’ attacks, Galaxy says
As of mid-August, Galaxy said it had identified roughly 1,779 BTC stolen from 190 victims and more than 8,600 addresses.
The Block•Danny Park7 Sept
Parked Coldcard loot begins moving as attacker routes $1.6M in stolen Bitcoin to Ethereum
Bitquery traced 20.45 BTC through 34 Sept. 2–3 swaps, and the main destination later held roughly 5 ETH less.
CryptoSlate•Liam 'Akiba' Wright3 Sept
Coldcard hacker uses THORChain to swap stolen BTC
A Coldcard attacker moved about 10% of stolen Bitcoin through THORChain into ETH as researchers traced a new Ethereum destination.
Coldcard hacker swaps stolen Bitcoin for ETH via THORChain
The third-wave Coldcard exploiter moved about 10% of stolen funds through THORChain as researchers traced the assets to a new Ethereum address.
Cointelegraph•Cointelegraph by Helen Partz3 Sept
Bitcoin Early Adopters Stir as 6,427 BTC Worth $500M Moves in August
Following the Coldcard exploit that occurred 30 days ago in July, the episode and others that followed appear to have rattled many long-term holders, as August brought an enormous wave of dormant coins moving to new addresses. According to the latest metrics, 6,427.59 dormant BTC worth $507 million moved for the first time in years […]
Bitcoin.com News•Jamie Redman30 Aug
Coinkite’s Coldcard Bug Exposed Single-Sig Risk. Multi-Vendor Multisig Is the New Bitcoin Custody Baseline
Bitcoin Magazine Coinkite’s Coldcard Bug Exposed Single-Sig Risk. Multi-Vendor Multisig Is the New Bitcoin Custody Baseline Coinkite now forces dice rolls and key-press entropy on new Coldcard seeds. The lasting lesson from the July–August 2026 thefts is not to abandon self-custody — it is to stop generating every key on one vendor. This post Coinkite’s Coldcard Bug Exposed Single-Sig Risk. Multi-Vendor Multisig Is the New Bitcoin Custody Baseline first appeared on Bitcoin Magazine and is written by Juan Galt .
Trezor, Onekey, Bitbox Sales Spike Amid Coldcard Crisis; Security Models Evolve
The Coldcard crisis has also tested hardware wallet manufacturers’ abilities to deal with sharply increased sales, as instead of giving up on self-custody, many Bitcoiners rushed to new devices while wallet teams prepared for the new AI-powered (in)security reality. Of the 13 hardware wallet manufacturers Bitcoin.com News contacted for comment, Trezor, Bitbox, and Onekey confirmed […]
Bitcoin.com News•Linas Kmieliauskas26 Aug
BlackRock attracts $5B as investors swap physical BTC for IBIT shares – Coldcard effect?
BlackRock reduced the minimum for BTC in-kind conversions from $25M to $1M.
AMBCrypto•Benjamin Njiri26 Aug
Coldcard hackers leave 87% of stolen Bitcoin unmoved after $114M theft
More than 87% of the Bitcoin attributed to the Coldcard hack has remained unmoved, leaving 1,561 BTC under attacker control after researchers linked the exploit to $114.7 million in losses. Galaxy Research has traced 1,789.28 BTC stolen from 8,865 addresses…
Galaxy puts Coldcard hack losses at 1,789 BTC, with 87% unmoved
Galaxy Research’s latest tally shows that more than half of 221 Coldcard hack victim reports involved individual losses exceeding 1 Bitcoin.
Cointelegraph•Cointelegraph by Helen Partz25 Aug
Coldcard now requires 65 key presses after seed exploit, while exposed funds still must move
Firmware 5.6.1 and 1.5.1Q harden new wallet creation but cannot repair a seed made on an affected release.
CryptoSlate•Liam 'Akiba' Wright23 Aug
Coldcard Firmware 5.6.1 Forces User Entropy Into Every New Seed After $100M Exploit
Coinkite has released new Coldcard firmware that forces users to provide their own randomness when generating new wallet seeds.
Coldcard Adds New Security Measures After $130 Million Bitcoin Exploit
Coinkite's latest firmware requires users to add their own randomness when generating wallet seeds and fixes additional security issues uncovered during a three-week review.