Coldcard Attacker Moves $7.7M in Bitcoin From Third-Wave Theft, Nearly Half of Stolen Haul

Systematic Vault Drainage Underway

The attacker responsible for the third wave of Coldcard thefts has moved $7.7 million in Bitcoin, representing nearly half of the cryptocurrency stolen during that particular attack phase, according to reporting from Decrypt and CoinDesk. The hacker constructed 293 separate vaults to store the stolen Bitcoin and is methodically emptying them in descending order by size, having now drained the 11 largest vaults.

This coordinated movement of funds suggests a deliberate strategy to gradually liquidate or transfer the stolen assets rather than moving everything at once, which could trigger heightened detection by blockchain monitoring services.

Broader Pattern Across Multiple Coldcard Incidents

The activity reflects an ongoing challenge across all Coldcard attacks. According to Galaxy Research cited by Cointelegraph, approximately 82% of Bitcoin stolen across all waves of Coldcard breaches remains stationary in original addresses, while 18% has been moved in apparent laundering attempts. This suggests the third-wave attacker is among the more active perpetrators in attempting to move stolen funds.

The Coldcard hardware wallet attacks have impacted users across multiple incident waves, with attackers gaining access to significant quantities of cryptocurrency. The measured pace of fund transfers observed in this case may indicate the attacker is attempting to avoid detection while gradually converting or mixing the stolen assets.

This article was written by our AI pipeline from aggregated headlines and live market data. Not financial advice.