A Coldcard Hacker Just Moved $1.94 Million in Stolen Bitcoin for the First Time, Is a Cash-Out Coming?

In the latest Bitcoin news, a wallet associated with the Coldcard hack transferred 30.185 BTC, worth about $1.94 million, to a newly created address on Aug. 7, according to on-chain tracker Lookonchain.

The movement followed weeks of inactivity and represents roughly 1.5% of the estimated 2,055 BTC linked to the theft.

The #Coldcard hacker, who stole 2,055 $BTC($130M), is active again.

An hour ago, the hacker transferred 30.185 $BTC($1.94M) to a new wallet.https://t.co/Edirjbd2G0https://t.co/ksoTpGxx3g pic.twitter.com/VTL5UB9xgH

The transfer does not confirm that the bitcoin will be sold or exchanged. However, Lookonchain reported that it was the attacker’s first movement since the initial theft, drawing attention to whether further transfers follow.

Discover: Everyone’s Got a Take. Get Free $25 to Actually Trade Yours

The wallet activity follows a major hardware-wallet breach involving more than $100 million in reported losses. On-chain analysis from Galaxy Research identified three confirmed attack waves that drained 1,596 BTC from roughly 7,300 addresses.

A suspected fourth wave could bring the total to about 2,055 BTC, valued at roughly $130 million.

Before the latest transfer, Galaxy Research said roughly 90% of the stolen bitcoin had not moved from the wallets where it was sent after the reported theft.

Because bitcoin transactions are public on the blockchain, identified attacker addresses can be tracked as funds move between wallets.

On-chain analysts have described the transfer as a possible early sign of an attempted cash-out. Attackers seeking to convert stolen assets may move funds through a series of wallets before attempting to exchange them for other assets or fiat currency.

Discover: Your Market Calls Are Worth Something. Start With Free $25 on Kalshi

The breach stemmed from a software vulnerability in Coldcard hardware wallets made by Toronto-based Coinkite. In an update, Coinkite said affected firmware dating to March 2021 used a deterministic pseudo-random generator instead of the intended hardware-backed true random number generator when generating wallet seeds.

URGENT COLDCARD SECURITY UPDATE

Read carefully before acting.

Mk3 seed generated on 4.0.1+ without ≥50 private, independent dice rolls: begin a careful migration now.

Mk4/Mk5