In a dramatic escalation of cryptocurrency crime, a sophisticated attacker has successfully moved approximately $7.7 million worth of Bitcoin, representing roughly 45 percent of the total digital assets stolen during the third wave of Coldcard-related breaches. This development was confirmed by Galaxy Research, a firm that tracks blockchain activity and cyber‑financial threats, which reported that the hacker has now drained the eleven largest vaults that were tied to this particular series of attacks. The Coldcard hardware wallet, renowned for its robust security features and offline signing capabilities, has long been a favored tool among privacy‑conscious users and institutional investors alike. Yet, despite its reputation, the device has become the focal point of a series of coordinated thefts that have unfolded in distinct phases, each more complex than the last.
The first wave of attacks targeted relatively small balances, but the third wave—now under intense scrutiny—has demonstrated a markedly higher level of organization and technical proficiency. According to the timeline assembled by Galaxy Research, the third wave began in early 2024 when threat actors identified a vulnerability in the supply chain of certain Coldcard units. By exploiting this weakness, they were able to embed malicious firmware that silently recorded private keys when the wallet was later used in normal transactions.
Once the keys were harvested, the attackers could silently transfer the stored Bitcoin to addresses under their control, often employing a series of mixing services and tumblers to obscure the trail. What sets this latest wave apart is the sheer scale of the thefts. The eleven largest vaults—each holding tens of thousands of Bitcoin—were systematically emptied over a period of weeks.
In total, the hacker moved close to $7.7 million worth of Bitcoin, a figure that translates to roughly 45 percent of all the cryptocurrency taken in this particular wave. The remaining 55 percent of the stolen assets remain scattered across smaller accounts, many of which have yet to be identified or linked to the primary perpetrator. The methodology behind the transfers suggests a deep understanding of blockchain analytics and anti‑tracing techniques. After extracting the private keys, the attacker did not simply send the Bitcoin to a single address.
Instead, they employed a multi‑step process involving chain‑hopping, where the stolen coins were first converted into other cryptocurrencies such as Ethereum and Litecoin, before being funneled back into Bitcoin through decentralized exchanges (DEXs). This approach makes it significantly harder for investigators to trace the original source of the funds, as each conversion erases a portion of the transaction metadata. In addition to chain‑hopping, the hacker leveraged privacy‑enhancing services like CoinJoin and various mixing platforms.
By pooling the stolen Bitcoin with legitimate transactions from unrelated users, the attacker created a camouflage that further muddles any forensic analysis. These services are often marketed as tools for preserving financial privacy, but in this case, they have been weaponized to facilitate large‑scale theft. The impact of this breach extends beyond the immediate financial loss.
Trust in hardware wallets—a cornerstone of cryptocurrency security—has been shaken. Users who rely on Coldcard for its air‑gapped design now face heightened concerns about the integrity of their devices, especially those purchased from third‑party distributors or secondary markets.
Industry experts warn that the supply‑chain vulnerability exploited in this case could be replicated across other hardware wallet manufacturers if proper safeguards are not implemented. In response to the ongoing investigation, Galaxy Research has issued several recommendations for both users and manufacturers. For users, the primary advice is to verify the provenance of any hardware wallet before purchase, ensuring that the device has not been tampered with during transit.
They also suggest performing a firmware integrity check using official verification tools provided by the manufacturer. For manufacturers, the report emphasizes the need for enhanced tamper‑evident packaging, cryptographic attestation of firmware, and regular security audits of the production process. Regulatory bodies are also taking note. The U.S.
Treasury’s Office of Foreign Assets Control (OFAC) and the Financial Crimes Enforcement Network (FinCEN) have begun to explore the possibility of issuing new guidance on hardware wallet security, aiming to protect investors from similar attacks in the future. Meanwhile, law enforcement agencies across several jurisdictions are collaborating to trace the illicit funds, despite the sophisticated obfuscation techniques employed. The broader cryptocurrency community has reacted with a mixture of alarm and resilience.
Forums and social media platforms are buzzing with discussions about best practices for securing digital assets, and many users are re‑evaluating their reliance on hardware wallets versus alternative solutions such as multi‑signature vaults and custodial services with insurance coverage. While the $7.7 million in Bitcoin has been moved, it has not yet vanished entirely from the blockchain. Analysts continue to monitor the destination addresses, looking for signs of liquidation or further movement that could provide clues about the ultimate end‑user of the stolen funds.
Some speculate that the attacker may be waiting for market conditions to improve before converting the assets into fiat currency, thereby minimizing the risk of detection. In conclusion, the third wave of Coldcard thefts marks a pivotal moment in the ongoing battle between cryptocurrency security and cyber‑criminal innovation. The successful transfer of nearly half of the stolen Bitcoin underscores the attackers’ technical prowess and the challenges faced by investigators in an environment where anonymity tools are constantly evolving.
As the industry grapples with these threats, the emphasis on rigorous supply‑chain security, user education, and proactive regulatory measures will be essential to restoring confidence in hardware wallets and safeguarding the broader digital asset ecosystem.