Coldcard Hacker Moves $1.94 Million in Stolen Bitcoin

A wallet linked to the significant Coldcard hardware hack recently transferred 30.185 Bitcoin, which is worth about $1.94 million. This move marks the first time these funds have shifted since the original theft occurred. On chain trackers identified the transaction as the attacker sent the assets to a fresh, empty address.

The hacker is currently linked to the theft of roughly 2,055 Bitcoin, a total value near $130 million. While this single transfer represents only a small fraction of the total stolen stash, it has caught the attention of security experts who watch for signs of a cash out. Attackers often route stolen crypto through various wallets to obscure the trail before attempting to exchange it for other assets or government currency.

This security breach originated from a flaw in specific Coldcard firmware, which failed to generate truly random wallet seeds. This vulnerability allowed attackers to reconstruct private keys without needing physical access to the devices. Coinkite, the maker of the hardware wallets, has since issued updates and urged users to move funds to new, secure seeds.

Analysts and law enforcement are currently monitoring the new address to see if the funds continue to move. Because Bitcoin transactions are public, any further activity will likely be flagged immediately. For now, the crypto community is watching closely to see if this transfer is a one time event or the start of a broader attempt to liquidate the stolen holdings.