Coldcard Hacker Moves 45% of Bitcoin Stolen in Third Attack, Launders Funds Through CoinJoin

The hacker behind the attack on Bitcoin hardware wallet Coldcard has moved 45% of the assets stolen in the third attack.

The Block reported on September 7 that Galaxy Research said the suspected hacker behind Coldcard’s third attack continues to move the stolen Bitcoin. After swapping part of the stolen funds into Ether through THORChain on September 2, the hacker moved more Bitcoin on September 6 using CoinJoin.

A total of 97.09 BTC, worth about $7.8 million, has been moved so far. According to Galaxy Research, the hacker has been shifting funds starting with the wallets holding the largest amounts. Funds from the 11 largest wallets have already been moved. The next 10 untouched wallets still hold a combined 30.81 BTC. Another 233 smaller wallets hold 33.77 BTC.

Looking at the Coldcard attack overall, about 82% of the stolen assets still remain at the addresses that first received the funds. The rest is believed to have been moved to other addresses for purposes including laundering.

The attack stemmed from a flaw in Coldcard firmware distributed in 2021. The bug weakened randomness in the wallet seed-generation process. That allowed the attacker to brute-force private seed phrases and drain funds from single-signature wallets without directly accessing the devices.

Galaxy Research estimated that about 1,779 BTC had been stolen from roughly 190 victims and more than 8,600 addresses as of mid-August. It later found additional evidence showing that funds from 58 previously unidentified addresses were also used in transactions tied to the attacker. Including those funds, cumulative losses rise to 1,806 BTC, worth about $143.9 million at current prices.