COLDCARD Attacker Hides Stolen Funds, Total Losses Estimated Over $110M

Galaxy Research has identified the largest known COLDCARD attacker as controlling 1,159 BTC across seven addresses. Despite this significant amount, none of it has been transferred to an identifiable cash-out service or mixer.

A separate attacker has begun attempting to obscure part of the stolen funds by sending 64 BTC toward a mixer. Approximately 10 BTC was initially mixed, while about 54 BTC returned as change. The remaining funds were subsequently divided into outputs of roughly 7 BTC each for further mixing.

On-chain investigators have detected this activity and continue to monitor it, making it easier to follow the transactions as they pass through additional addresses. This separate attack appears distinct from the seven-address cluster holding 1,159 BTC.

Galaxy previously confirmed that attackers stole 1,596 BTC from approximately 7,300 addresses across three attack waves, with a suspected fourth wave potentially raising the total to around 2,055 BTC. The vulnerability resulted from a firmware error that weakened the randomness used to generate wallet seed phrases, allowing attackers to reproduce possible seeds offline and derive their Bitcoin addresses.