Coldcard Thief Targets with Brazen Onchain Laundering Offer

The Coldcard security incident has taken another turn as a brazen bitcoin laundering offer was made public onchain to the thief behind one of the largest self-custody bitcoin thefts ever recorded. The estimated total stolen is roughly 1,359.8820 BTC, with most of the identified coins remaining in a handful of addresses under the attacker's control.

On August 1, an OP_RETURN message was sent to one of the attacker's holding addresses containing a 10% laundering offer and a Telegram contact. Speculators wonder if it is a serious offer or a honeypot, with some suggesting it could be law enforcement or someone setting a trap.

The theft involved more than 1,300 BTC, but much of the bitcoin remains largely untouched due to its transparency on the blockchain. The attacker consolidated funds into a relatively small number of addresses after sweeping vulnerable wallets during several coordinated waves beginning on July 30.