The hacker behind the Coldcard wallet exploit, believed to hold 2,055 BTC (about $130 million) in stolen bitcoin, moved funds for the first time in weeks, sending 30.185 BTC (about $1.94 million) to a new wallet.
Key Takeaways
The Coldcard hacker moved 30.185 BTC, worth about $1.94 million.The attacker is believed to hold 2,055 BTC, worth roughly $130 million, from the original exploit.Onchain analysts flagged the transfer as a possible sign the hacker is preparing to cash out.The move is small relative to the hacker’s total holdings, representing roughly 1.5% of the stolen funds, but it is significant because it breaks a pattern of dormancy that had left investigators and the wider Bitcoin community watching an otherwise untouched pile of stolen coins.
What the Transfer Potentially MeansOnchain analysts commonly treat a dormant hacker’s first movement of stolen funds as an early signal of an attempted cash-out, since attackers typically need to move coins through a series of wallets, mixers, or cross-chain bridges before attempting to convert them into other assets or fiat currency without immediately attracting attention.
The underlying vulnerability traces back to a firmware bug in Coldcard devices made by Toronto-based manufacturer Coinkite, which caused certain units to generate seeds with a fraction of their intended cryptographic randomness. That left long-term holders who generated wallets on affected firmware versions exposed to brute-force attacks capable of reconstructing their private keys.
The renewed activity from one of the exploit’s largest single beneficiaries is likely to reignite attention on a story that had begun to quiet down as the pace of new draining slowed. For victims still hoping for some path to recovery, a hacker moving funds proves the coins still exist and remain traceable on a public ledger, but it also raises the odds that at least a portion of the stolen bitcoin is about to become far harder to follow.
Over the coming few days, experts will likely keep a close watch on the destination wallet for any further movement, since subsequent transfers often reveal whether a hacker is testing a laundering route, consolidating funds ahead of a larger move, or responding to some outside pressure.
