Coldcard hackers transfer 64 BTC and 200 ETH to cryptocurrency mixers
About 64 BTC ($4.17 million) and 200 ETH ($380,000) tied to the Coldcard exploit were moved into mixing services: the Bitcoin went to Wasabi and the Ether to Tornado Cash. CertiK said the activity may reflect smaller copycat attackers rather than a single actor. Mixing protocols obscure onchain trails, making stolen funds harder to trace and recover. TRM Labs found most victim funds remain concentrated in a few attacker-controlled addresses, with only limited mixing so far. Its analysis suggests multiple attackers were involved, consistent with Galaxy Digital’s earlier estimate of at least 15 distinct attackers. Galaxy said the exploit has already drained at least $100 million in BTC from 7,300 wallets across three confirmed waves, with a possible fourth wave pushing losses near $130 million. TRM linked the attack to a March 2021 firmware bug that weakened seed randomness on some Coldcard wallets, reducing key strength from 128 bits to 40 bits and making brute-force recovery possible without physical access.
