Coldcard Hackers Mingle Stolen Funds with Cryptocurrency Mixers

The Coldcard exploit has become one of the largest cryptocurrency hacks this year, draining at least $100 million in Bitcoin across three confirmed attack waves from 7,300 victim wallets. According to blockchain security platform CertiK, hackers transferred 64 BTC worth $4.17 million and 200 ETH worth $380,000 to cryptocurrency mixers.

The 64 BTC was sent to the Wasabi mixing protocol on Tuesday, while the 200 ETH was transferred to Tornado Cash on Wednesday. These protocols obscure the publicly traceable onchain link between senders and recipients, making it difficult to recover stolen funds.

CertiK believes there may be multiple attackers behind the exploit, with at least 15 different hackers identified by Galaxy Digital. The suspected fourth wave could bring total losses to about $130 million in BTC. TRM Labs analysis revealed that a firmware bug from March 2021 weakened seed randomness on some Coldcard wallets, making them vulnerable to brute-force attacks.