Coldcard Hack: $1.94M Bitcoin Transfer Tracked

The transfer does not confirm that the bitcoin will be sold or exchanged. However, Lookonchain reported that it was the attacker’s first movement since the initial theft, drawing attention to whether further transfers follow.

Discover: Everyone’s Got a Take. Get Free $25 to Actually Trade Yours

Bitcoin News: On-Chain Tracking Flags BTC Cash-Out Risk

The wallet activity follows a major hardware-wallet breach involving more than $100 million in reported losses. On-chain analysis from Galaxy Research identified three confirmed attack waves that drained 1,596 BTC from roughly 7,300 addresses.

A suspected fourth wave could bring the total to about 2,055 BTC, valued at roughly $130 million.

Before the latest transfer, Galaxy Research said roughly 90% of the stolen bitcoin had not moved from the wallets where it was sent after the reported theft.

Because bitcoin transactions are public on the blockchain, identified attacker addresses can be tracked as funds move between wallets.

On-chain analysts have described the transfer as a possible early sign of an attempted cash-out. Attackers seeking to convert stolen assets may move funds through a series of wallets before attempting to exchange them for other assets or fiat currency.

Discover: Your Market Calls Are Worth Something. Start With Free $25 on Kalshi

Firmware Flaw Exposed Cold Storage Devices

The breach stemmed from a software vulnerability in Coldcard hardware wallets made by Toronto-based Coinkite. In an update, Coinkite said affected firmware dating to March 2021 used a deterministic pseudo-random generator instead of the intended hardware-backed true random number generator when generating wallet seeds.

The flaw allowed attackers to reconstruct wallet seed phrases or private keys without physically obtaining the devices. Seed phrases act as the keys used to authorize bitcoin transactions.

Coinkite advised users who generated seeds on vulnerable firmware to move their funds to safe addresses or use fresh seeds. The company also released firmware updates, though existing seed phrases generated on vulnerable devices remain at risk and should be replaced, according to the company and Galaxy Research.

What to Watch as Attacker Wallets Awaken

The immediate focus is on whether the 30.185 BTC sent to the new address moves again.

Further transfers could provide additional information about how the stolen funds are being handled, though the initial transfer alone does not establish the purpose of the movement.

Galaxy Research said details from the ongoing investigation, including attacker and victim addresses, have been shared with U.S. law enforcement agencies, cryptocurrency exchanges and cyber-investigation groups.

The firm said identifying additional attacker addresses remains important so those addresses can be reported to authorities.

Discover: Get Paid to Be Right, $25 to Start on Kalshi

Don’t Miss Out on Our $1,000 USDT Airdrop on ByBit