Stolen Bitcoin linked to the Coldcard wallet vulnerability started moving through a mixer. However, most of the stolen cryptocurrency is still unmoved.
The largest known attacker still controls approximately 1,159 BTC across seven addresses, but investigators are monitoring hundreds of wallets connected to the wider exploit.
Attacker Leaves 1,159 BTC Unmoved
Galaxy Research said the largest theft connected to the Coldcard vulnerability involved 1,159 BTC. The funds are distributed across seven attacker-controlled addresses and have not moved since the initial consolidation.
On-chain investigators said the Bitcoin was stolen within approximately 41 minutes. No transfers from the seven addresses to exchanges, mixers or other identifiable services have been detected.
The funds are not technically frozen. Bitcoin transactions cannot be stopped at the protocol level simply because an address has been flagged. However, the attacker could struggle to convert such a large amount without attracting attention. Exchanges, law enforcement agencies and blockchain analytics companies have reportedly flagged roughly 600 addresses associated with the broader theft.
A transfer to a regulated exchange could trigger anti-money-laundering controls and requests for information about the account receiving the funds.
Separate Attacker Begins Mixing Bitcoin
While the largest stash is still untouched, analysts have identified a separate attacker trying to obscure approximately 64 BTC.
Around 10 BTC initially entered a mixing transaction, while approximately 54 BTC returned as change. The remaining funds were later divided into outputs of roughly 7 BTC each, apparently for additional mixing.
The activity reportedly involved Wasabi Wallet, which uses CoinJoin transactions to make it more difficult to connect specific Bitcoin inputs with their resulting outputs.
Mixers can complicate blockchain investigations, but they do not guarantee that funds become untraceable. Transaction timing, output sizes, later consolidations and interactions with exchanges can still provide investigators with useful clues.
The mixing activity also seems separate from the seven-address cluster holding 1,159 BTC. Previous investigations indicated that multiple attackers may have exploited the same Coldcard weakness, which means that transactions from one cluster should not be attributed to every theft.
Coldcard Losses Could Exceed $100 Million
Estimates of the total amount stolen vary. Galaxy Research previously estimated that confirmed losses reached approximately 1,596 BTC, while a suspected additional attack wave could push the total to around 2,055 BTC. Other researchers have estimated losses of more than 1,800 BTC.
The vulnerability was linked to seed phrases created by affected COLDCARD devices using weakened random-number generation. Updating the firmware prevents new wallets from being generated through the vulnerable process, but it does not repair an existing compromised seed.
Affected users must create a completely new wallet seed and transfer their Bitcoin to addresses generated from it.
