{"id":76490,"date":"2026-08-07T07:59:21","date_gmt":"2026-08-07T07:59:21","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/coldcard-hacker-resumes-moving-stolen-30-btc-to-new-wallet\/"},"modified":"2026-08-07T07:59:21","modified_gmt":"2026-08-07T07:59:21","slug":"coldcard-hacker-resumes-moving-stolen-30-btc-to-new-wallet","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/coldcard-hacker-resumes-moving-stolen-30-btc-to-new-wallet\/","title":{"rendered":"Coldcard Hacker Resumes Moving Stolen 30 BTC to New Wallet"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<div class=\"@container mb-[25px] rounded-sm overflow-clip py-0.5 pr-0.5 pl-2.5 bg-success-100\">\n<div class=\"flex flex-col gap-m overflow-clip rounded-[6px] !bg-success-10 p-3 @[420px]:p-m\">\n<h2 class=\"m-0 flex items-center gap-s text-[19px] !text-[#1c1c1c] md:text-[20px]\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"10\" viewbox=\"0 0 16 10\" fill=\"none\" class=\"shrink-0 text-success-100\" aria-hidden=\"true\"><path d=\"M1 1.5h14\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><path d=\"M1 8.5h10\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><\/svg><span>Key Takeaways<\/span><\/h2>\n<ul class=\"m-0 flex list-none flex-col gap-m pl-0\">\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">The Coldcard hacker moved 30.185 BTC, worth about $1.94 million.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">The attacker is believed to hold 2,055 BTC, worth roughly $130 million, from the original exploit.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Onchain analysts flagged the transfer as a possible sign the hacker is preparing to cash out.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2>The Hacker Goes Quiet, Then Moves Again<\/h2>\n<p>Just hours ago, the hacker behind the largest share of the theft, holding 2,055 BTC worth roughly $130 million, <a href=\"https:\/\/x.com\/lookonchain\/status\/2085593899465416881\" target=\"_blank\" rel=\"noopener noreferrer\">resurfaced to move 30.185 BTC<\/a>, worth about $1.94 million, to a newly created wallet. Other onchain sleuths corroborated the transfer within minutes of each other, describing it as the hacker\u2019s first activity since the initial theft.<\/p>\n<figure id=\"attachment_837530\" aria-describedby=\"caption-attachment-837530\" style=\"width:1357px\" class=\"wp-caption aligncenter\"><figcaption id=\"caption-attachment-837530\" class=\"wp-caption-text\">Image source: X<\/figcaption><\/figure>\n<p>The move is small relative to the hacker\u2019s total holdings, representing roughly 1.5% of the stolen funds, but it is significant because it breaks a pattern of dormancy that had left investigators and the wider Bitcoin community watching an otherwise untouched pile of stolen coins.<\/p>\n<p>Bitcoin.com News previously reported that the theft, which affected Coldcard Mk3 devices running vulnerable firmware, <a href=\"https:\/\/news.bitcoin.com\/security\/coldcard-hack-116-million-fourth-wave\/\">climbed past $116 million<\/a> across more than 1,800 BTC pulled from over 5,200 addresses as additional waves of draining were discovered in the weeks after the initial disclosure.<\/p>\n<h2>What the Transfer Potentially Means<\/h2>\n<p>Onchain analysts commonly treat a dormant hacker\u2019s first movement of stolen funds as an early signal of an attempted cash-out, since attackers typically need to move coins through a series of wallets, mixers, or cross-chain bridges before attempting to convert them into other assets or fiat currency without immediately attracting attention.<\/p>\n<p>The Coldcard hacker\u2019s situation is complicated by how closely the stolen funds have been watched, given that he previously <a href=\"https:\/\/news.bitcoin.com\/crypto-news\/coldcard-hacker-gets-brazen-bitcoin-laundering-offer-onchain\/\">received a brazen offer<\/a> from another party proposing to help launder the funds directly onchain, an unusual public overture given how much scrutiny the wallets involved have received from the broader security community.<\/p>\n<p>Separately, onchain investigator ZachXBT has said he has <a href=\"https:\/\/news.bitcoin.com\/security\/zachxbt-declines-trace-coldcard-hack\/\">no plans to personally trace<\/a> the stolen funds, leaving that work to other researchers and the handful of blockchain analytics accounts that have kept the wallets under close watch since the exploit first came to light.<\/p>\n<h2>A Reminder of the Exploit\u2019s Scale<\/h2>\n<p>The underlying vulnerability traces back to a firmware bug in Coldcard devices made by Toronto-based manufacturer Coinkite, which caused certain units to generate seeds with a fraction of their intended cryptographic randomness. That left long-term holders who generated wallets on affected firmware versions exposed to brute-force attacks capable of reconstructing their private keys.<\/p>\n<p>Bitcoin.com News has reported that Canadian users alone accounted for <a href=\"https:\/\/news.bitcoin.com\/security\/canadian-users-account-for-25-of-coldcard-exploit-losses\/\">roughly a quarter of all attributable losses<\/a>, a detail that lines up with Coinkite\u2019s own Toronto base and suggests the affected devices may have circulated more heavily in that market.<\/p>\n<p>The renewed activity from one of the exploit\u2019s largest single beneficiaries is likely to reignite attention on a story that had begun to quiet down as the pace of new draining slowed. For victims still hoping for some path to recovery, a hacker moving funds proves the coins still exist and remain traceable on a public ledger, but it also raises the odds that at least a portion of the stolen bitcoin is about to become far harder to follow.<\/p>\n<p>Over the coming few days, experts will likely keep a close watch on the destination wallet for any further movement, since subsequent transfers often reveal whether a hacker is testing a laundering route, consolidating funds ahead of a larger move, or responding to some outside pressure.<\/p>\n<\/p><\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/featured\/coldcard-hacker-resumes-moving-stolen-bitcoin\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways The Coldcard hacker moved 30.185 BTC, worth about $1.94 million. The attacker is believed to hold 2,055 BTC, worth roughly $130 million, from the original exploit. Onchain analysts flagged the transfer as a possible sign the hacker is preparing to cash out. The Hacker Goes Quiet, [&hellip;]<\/p>\n","protected":false},"author":3947362404,"featured_media":76491,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/76490"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/3947362404"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=76490"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/76490\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/76491"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=76490"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=76490"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=76490"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}