Coldcard hacker moves $7.7 million in BTC, 45% of bitcoin stolen in third attack wave
Hackers exploiting a firmware vulnerability in Coldcard hardware wallets have moved millions in Bitcoin, with 45% of the stolen funds transferred in a third wave of attacks. Galaxy Research reports that the attacker is systematically emptying vaults, using techniques like CoinJoin to obscure the trail of the stolen assets.
Why it matters
This exploit highlights significant security risks in hardware wallet firmware and the challenges of recovering assets once they are moved through decentralized mixers.
Galaxy Research said the attacker routed about 20.5 BTC from its largest vault through decentralized exchange THORChain on Sept. 2, with the proceeds landing on Ethereum.
It then sent 15.48 BTC from the second-largest vault into a CoinJoin transaction on Sept. 5, followed by another 61.12 BTC from 10 vaults the next day.
CoinJoin combines bitcoin transactions from multiple users, making it harder to link specific inputs with their eventual outputs.
Galaxy said the attacker has been working through the 293 vaults in order of size and has now emptied the 11 largest. The next 10 hold 30.81 BTC, while vaults ranked 61 through 293 contain a combined 33.77 BTC.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in