A Bitcoin wallet associated with the Coldcard hardware wallet breach transferred 30.185 BTC, valued at roughly $1.94 million, to a newly created address on August 7. On-chain analytics firm Lookonchain was the first to observe the transfer, which marked the first movement of stolen funds since the initial attack.
USDT
AAPLResurgence of hacker activity after long silence
The transfer accounted for about 1.5% of the estimated 2,055 BTC stolen in the attack. Prior to this movement, the majority of the stolen assets had remained untouched, according to data from Galaxy Research. This latest activity gives analysts renewed insight into how the attacker is handling the stolen funds and where they might be sent next.
Galaxy Research, a digital asset research firm, previously confirmed that three distinct attacks resulted in the loss of 1,596 BTC from over 7,300 wallet addresses. Should a fourth attack take place, total losses could climb to nearly 2,055 BTC—worth approximately $130 million at the current rate.
Coldcard, manufactured by Coinkite, is a hardware wallet designed to add an extra layer of security for storing Bitcoin private keys. A flaw discovered in its firmware has put funds at significant risk.
Mini dictionary: Coldcard, a hardware wallet produced by Coinkite, is a specialized device used to securely store cryptocurrency private keys offline, providing enhanced protection against cyberattacks.
Security flaw and user risks
The vulnerability that allowed the breach stemmed from a deterministic pseudo-random generator used in the wallet seed creation, according to Coinkite. This flawed implementation replaced the intended hardware-based true random number generator, leaving affected wallets exposed. With seed phrases and private keys compromised, attackers gained the power to access and move users’ coins without physical access to the devices.
Coinkite notified its customers about the risk and advised those who created seed phrases with the affected firmware to transfer their holdings to new addresses and regenerate wallet seeds. While firmware updates have since been released, funds linked to the previously vulnerable seeds remain at risk until users take recommended actions.
Tracing the stolen Bitcoin
All Bitcoin movements are publicly viewable on the blockchain, enabling investigators and on-chain analysts to track the progress of stolen coins. Historically, attackers attempt to move illicit funds through multiple wallets before reaching exchanges, hoping to mask the origin and cash out. However, the latest transfer does not confirm whether a sale is imminent and the funds may sit idle or move again.
| Event | BTC Amount | Value (Approx.) |
|---|---|---|
| Total stolen | 2,055 | $130 million |
| Moved on Aug. 7 | 30.185 | $1.94 million |
| Unmoved (prior to Aug. 7) | ~2,025 | ~$128 million |
Galaxy Research reported that it has shared detailed information about attacker and victim wallet addresses with US law enforcement, major cryptocurrency exchanges, and cybercrime units. This collaboration aims to support ongoing monitoring and potential identification of those responsible.
Coinkite alerted customers who created seed phrases on the affected firmware, urging them to move funds to secure wallets and update to the latest software for continued protection.
As attention now shifts to the newly activated address, analysts will monitor subsequent Bitcoin movements in hopes of uncovering more about the attacker’s strategies or attempts to liquidate stolen assets.
