Coldcard Hacker Transfers $7.7 Million in Bitcoin, Accounting for 45% of Stolen Coins in Third Attack Wave

In a dramatic escalation of cryptocurrency crime, a sophisticated attacker has successfully moved roughly $7.7 million worth of Bitcoin, representing almost half of the total assets taken during the third wave of Coldcard-related thefts. This development, confirmed by the blockchain analytics firm Galaxy Research, marks the latest chapter in a series of coordinated attacks that have targeted the popular hardware wallet known as Coldcard, which is prized for its emphasis on security and air‑gapped operation. **Background to the Coldcard saga** Coldcard, manufactured by Coinkite, has long been a favorite among privacy‑conscious Bitcoin holders because it stores private keys offline and requires physical confirmation for every transaction.

Despite these safeguards, the device has become the focal point of a series of high‑profile breaches that have unfolded in multiple waves since early 2024. The first wave involved a modest number of compromised wallets, but the second wave saw attackers exploiting a vulnerability in the device’s firmware update mechanism, allowing them to inject malicious code that could silently exfiltrate seed phrases.

The third wave, which began in late summer, displayed a markedly higher level of organization. Rather than targeting individual users at random, the perpetrators appeared to have compiled a list of the largest Coldcard vaults—those holding the most valuable balances—and executed a coordinated series of transactions designed to bypass typical detection thresholds. Galaxy Research’s latest report indicates that eleven of the largest vaults have now been completely drained, a figure that represents roughly 45 percent of the total Bitcoin taken in this wave. **How the attacker operated** According to the forensic analysis, the attacker leveraged a combination of social engineering, supply‑chain compromise, and a subtle firmware backdoor that had evaded detection during routine audits.

The process began with the distribution of seemingly legitimate firmware updates to a subset of Coldcard users. These updates were signed with a forged certificate that mimicked Coinkite’s official signing key, a trick made possible by a compromised certificate authority that had been quietly infiltrated months earlier.

Once the malicious firmware was installed, it created a hidden channel that could receive encrypted commands from a remote command‑and‑control server. The attacker then used this channel to request the generation of new receiving addresses, which were automatically added to the wallet’s address book. Because Coldcard requires physical confirmation for each outgoing transaction, the malicious code was designed to simulate button presses, effectively fooling the user into approving transfers they never intended to make. The attacker’s strategy was to wait until the victim’s balance reached a threshold that would not trigger automatic alerts on most blockchain monitoring services.

By moving funds in incremental amounts—often just under the $10,000 mark per transaction—they were able to stay under the radar of many exchange‑level anti‑money‑laundering (AML) systems. However, once a sufficient volume had been accumulated in a single address, the attacker executed a large “sweep” transaction, consolidating the stolen Bitcoin into a handful of addresses under their control.

**The $7.7 million transfer** The most recent activity, which Galaxy Research flagged on September 10, involved a rapid series of outbound transactions from the final five compromised vaults. In total, the attacker moved approximately 210 BTC, valued at $7.7 million at current market rates. The transfers were routed through a series of mixing services and privacy‑enhancing protocols, including CoinJoin and a chain‑hop through the Lightning Network, making it extremely difficult for investigators to trace the final destination of the funds. Interestingly, the attacker appears to have employed a “layered” approach to laundering.

After the initial mix, the Bitcoin was split into smaller parcels and sent to a network of newly created wallets that have never been associated with illicit activity. Some of these wallets were subsequently used to purchase privacy‑focused tokens, which were later swapped back into Bitcoin on decentralized exchanges (DEXs) that do not enforce KYC (Know Your Customer) requirements. This multi‑step process not only obscures the trail but also introduces additional friction for any law‑enforcement agency attempting to follow the money. **Implications for the crypto community** The scale and sophistication of this third‑wave attack have sent shockwaves through the cryptocurrency ecosystem.

First, it underscores the persistent risk that even hardware wallets—often touted as the gold standard for cold storage—are not immune to advanced supply‑chain attacks. Users who rely solely on the device’s offline nature without implementing additional safeguards, such as multi‑signature setups or air‑gapped transaction signing, are especially vulnerable.

Second, the incident highlights the evolving tactics of cybercriminals who are increasingly adept at blending social engineering with technical exploits. The forged firmware update illustrates that attackers are willing to invest significant resources to compromise the trust model that underpins hardware wallet security. Third, the use of privacy‑enhancing tools in the laundering process raises concerns for regulators. While these tools serve legitimate privacy needs, they also provide a convenient veil for illicit actors.

The incident may accelerate calls for stricter standards around firmware signing, certificate authority oversight, and mandatory security audits for hardware wallet manufacturers. **What users can do** In light of these developments, experts recommend several practical steps for Coldcard owners and broader crypto users: 1. **Verify firmware signatures manually** – Before installing any update, compare the provided signature against the official public key published on Coinkite’s website.

2. **Adopt multi‑signature wallets** – Requiring two or more independent keys to approve a transaction dramatically reduces the chance that a single compromised device can drain funds. 3.

**Use air‑gapped transaction signing** – Generate transaction data on an offline computer, sign it on the Coldcard, and then broadcast it from a separate online device. 4. **Monitor address activity** – Employ blockchain analytics tools that can alert you to any unexpected outgoing transactions, even those below typical reporting thresholds.

5. **Stay informed about security advisories** – Follow official channels for any announcements about vulnerabilities or patches, and apply updates promptly.

**Looking ahead** Galaxy Research’s findings suggest that the attacker may still possess additional, undisclosed vaults, potentially holding more Bitcoin that could be moved in the coming weeks. The firm is collaborating with law‑enforcement agencies across multiple jurisdictions, but the layered laundering strategy employed will likely extend the investigation timeline. For the broader crypto industry, this episode serves as a stark reminder that security is a moving target. As hardware manufacturers strengthen their defenses, attackers will continue to innovate, exploiting the weakest link in the supply chain or user behavior.

Continuous vigilance, rigorous security practices, and a healthy skepticism toward unsolicited updates remain the most effective defenses against such sophisticated threats. In summary, the recent $7.7 million Bitcoin transfer marks a significant milestone in the third wave of Coldcard thefts, illustrating both the scale of the loss—nearly half of the stolen assets—and the advanced methods used to conceal and launder the proceeds. Users, developers, and regulators alike must take heed and adapt their security postures to mitigate future risks.