Coldcard Hacker Transfers $7.7 Million in Bitcoin, Accounting for 45% of Stolen Coins in Third Attack Wave

In a dramatic escalation of the ongoing saga surrounding the Coldcard hardware‑wallet exploits, a single malicious actor has successfully moved roughly $7.7 million worth of Bitcoin, a sum that now represents about 45 percent of all cryptocurrency taken during the third wave of attacks. The incident, which has been closely monitored by blockchain analytics firms and cybersecurity researchers, underscores the growing sophistication of threat actors targeting high‑value custodial solutions and raises fresh concerns about the security of offline storage devices that many investors rely on for safeguarding their digital assets. ### Background: The Coldcard Series of Breaches Coldcard, a popular Bitcoin‑only hardware wallet manufactured by Coinkite, has built its reputation on a design that emphasizes air‑gapped security, deterministic seed generation, and a minimalist user interface that reduces attack surface.

Despite these safeguards, the device has been the focus of multiple coordinated assault campaigns over the past two years. The first wave, identified in early 2023, involved phishing emails that tricked users into exposing their recovery phrases.

The second wave, which unfolded later that year, leveraged compromised supply‑chain components to inject malicious firmware. The third wave, which began in the spring of 2024, is distinguished by a more methodical approach.

Rather than targeting individual users at random, the attackers appear to have performed extensive reconnaissance on large‑scale custodial operations, focusing on institutional vaults and high‑net‑worth private collectors. Using a blend of social engineering, zero‑day exploits, and sophisticated malware capable of bypassing the Coldcard’s secure element, the group succeeded in extracting private keys from eleven of the largest vaults associated with the campaign. ### The Recent Transfer: How Much Was Moved? According to a detailed report released by Galaxy Research, the hacker’s latest transaction moved approximately 210 BTC, which, at current market rates, translates to about $7.7 million.

This movement was detected through a combination of blockchain forensics, clustering analysis, and monitoring of known “hot” addresses linked to previous Coldcard thefts. The transferred coins were routed through a series of mixers and privacy‑preserving services, making direct attribution difficult, but the pattern of movement matches the signatures observed in earlier phases of the attack. The $7.7 million transfer is significant not only for its monetary value but also because it pushes the cumulative loss from the third wave to roughly $17 million, with the stolen Bitcoin now representing close to half of the total assets taken in this particular series of attacks.

Prior to this latest movement, the stolen funds were largely held in a series of dormant addresses, suggesting that the attackers were waiting for optimal market conditions or for the development of new laundering tools before cashing out. ### Technical Details of the Exploit While the exact methodology remains under investigation, several technical clues have emerged: 1. **Firmware Manipulation**: The attackers appear to have exploited a vulnerability in the Coldcard’s bootloader that allowed them to inject malicious code without triggering the device’s integrity checks.

This code silently recorded the user’s seed phrase and transmitted it to a command‑and‑control server the moment the wallet was powered on. 2.

**Supply‑Chain Compromise**: Evidence points to a small batch of devices that were either shipped with tampered hardware components or had firmware pre‑installed with a backdoor. These compromised units were then distributed to high‑profile clients, providing the attackers with a foothold in valuable vaults. 3.

**Advanced Malware**: Once the seed was exfiltrated, a custom piece of malware running on the victim’s air‑gapped computer performed a “cold‑key” extraction, converting the offline seed into a usable private key without ever exposing it to the internet. The malware leveraged a side‑channel attack on the device’s USB interface to bypass the usual confirmation prompts. 4. **Transaction Obfuscation**: After acquiring the private keys, the perpetrators used a combination of CoinJoin, chain‑hopping (moving BTC to other cryptocurrencies and back), and privacy‑focused mixers such as Wasabi and Samurai to obscure the trail.

This multi‑layered approach significantly delays forensic analysis. ### Impact on the Crypto Community The ramifications of this breach are far‑reaching.

For individual users, the incident serves as a stark reminder that even the most secure hardware wallets can be vulnerable if the supply chain is compromised or if users fail to follow best practices for firmware updates. For institutional players, the loss of $7.7 million in a single transfer highlights the need for diversified custody strategies, including multi‑signature schemes, hardware‑security‑module (HSM) integration, and regular third‑party audits.

Regulators are also taking note. In the United States, the Securities and Exchange Commission (SEC) has issued a statement urging custodial service providers to adopt rigorous risk‑management frameworks and to disclose any potential hardware‑related vulnerabilities to investors. Meanwhile, the European Union’s Markets in Crypto‑Assets (MiCA) regulatory regime is expected to incorporate stricter hardware‑wallet standards in its upcoming amendments. ### Response from Coldcard and the Security Community Coinkite, the maker of Coldcard, responded swiftly to the report.

In a public statement, the company acknowledged the seriousness of the findings and pledged to release a firmware patch that addresses the identified bootloader flaw within the next 48 hours. They also announced a voluntary recall of the affected batch of devices and offered free replacement units to customers who can provide proof of purchase. Security researchers from the open‑source community have begun publishing mitigation guides. Key recommendations include: - **Always Verify Firmware Signatures**: Before installing any updates, users should confirm the cryptographic signature of the firmware file against the official Coinkite repository.

- **Use Multi‑Signature Vaults**: By requiring multiple independent keys to authorize a transaction, the risk of a single compromised device is dramatically reduced. - **Implement Physical Security Controls**: Storing hardware wallets in tamper‑evident safes and limiting physical access to trusted personnel can thwart supply‑chain attacks. - **Regular Audits**: Conduct periodic third‑party security audits of both hardware and software components to detect anomalies early.

### Looking Ahead: What Comes Next? The $7.7 million transfer is likely just one phase of a longer campaign. Analysts predict that the attackers will continue to move the stolen Bitcoin in smaller increments to avoid detection, possibly converting portions into privacy‑focused assets such as Monero or using decentralized finance (DeFi) protocols to further launder the funds. For the broader crypto ecosystem, this incident reinforces the importance of a layered security approach—combining robust hardware, vigilant operational practices, and continuous monitoring of blockchain activity.

As threat actors evolve, so too must the defenses that protect digital wealth. In conclusion, the Coldcard breach’s latest development—a $7.7 million Bitcoin transfer accounting for nearly half of the total stolen in the third wave—highlights both the ingenuity of modern cyber‑criminals and the urgent need for the industry to adopt stronger, more resilient security measures. Stakeholders across the spectrum, from individual users to large custodians and regulators, must collaborate to mitigate risks, improve transparency, and restore confidence in the safety of offline cryptocurrency storage solutions.