Coldcard hackers transfer 64 BTC and 200 ETH to cryptocurrency mixers
Reported by Cointelegraph · AI-assisted summary by ChikoCorp AI News Desk
AI-generated summary based on the linked source; not independently verified. This is not investment advice. Verify market-moving details at the original publisher before acting. See our editorial policy, AI content policy, and financial disclaimer.
Summary
Hackers who exploited a vulnerability in Coldcard wallets have transferred about 64 Bitcoin (valued at $4.17 million) and 200 Ether ($380,000) to cryptocurrency mixing services, according to blockchain security firm CertiK. The Bitcoin was sent to the Wasabi mixing protocol, while the Ether was moved to Tornado Cash. CertiK suspects multiple attackers, including smaller copycats, are involved in exploiting the vulnerability.
Why it matters
The use of cryptocurrency mixers complicates tracking stolen funds by breaking the onchain link between senders and recipients, reducing the likelihood of recovering assets. This laundering activity follows a major exploit, making the Coldcard hack the third-largest crypto hack of 2026, and highlights ongoing risks related to wallet security and laundering mechanisms in the crypto ecosystem.
Key context
The Coldcard exploit drained at least $100 million in Bitcoin from over 7,300 victim wallets across three attack waves, with a possible fourth wave increasing losses to about $130 million, according to Galaxy Digital. TRM Labs identified a firmware bug from March 2021 that weakened wallet seed randomness, making cold wallets vulnerable to brute force attacks without physical access. Previous similar laundering cases include the $293 million Kelp DAO hack, where much of the stolen Ether was funneled through THORChain and Umbra.
Key numbers and entities
The address bc1q0 sent 64 BTC to Wasabi; 200 ETH was transferred to Tornado Cash. The Coldcard exploit has resulted in at least $100 million stolen Bitcoin, potentially rising to $130 million after further attacks. Galaxy Digital and blockchain security firms CertiK and TRM Labs are involved in analyzing the attacks. Dragonfly's managing partner Haseeb Qureshi commented on the exploit's preventability by AI-based techniques.
What remains unclear
The source does not flag open questions but indicates uncertainty about the exact number and identity of attackers, as multiple individuals may be exploiting the vulnerability simultaneously. The extent to which additional stolen funds have been laundered or recovered remains unreported.