Recent Findings on Coldcard Wallet Hacking Incident
Recent findings by Galaxy Research reveal that a significant portion of the Bitcoin pilfered during the Coldcard wallet hacking incident has been transacted by the exploiters. According to their report, a staggering 82% of the stolen Bitcoin is still housed in the original addresses controlled by the attackers, while only 18% has been moved, seemingly for laundering purposes.
Details of the Hacker’s Activities
The hacker involved in the third wave of the Coldcard attacks has been active in shifting approximately 45% of the stolen funds. This movement commenced on September 2, with the perpetrator utilizing platforms such as THORChain to convert some of the stolen Bitcoin into Ethereum. Additionally, funds were funneled into CoinJoin schemes, which amalgamate multiple transactions, making it increasingly difficult to trace the origin of the funds.
Galaxy highlighted that this particular hacker set up 293 multisignature vaults, specifically of the two-of-two type, to store the stolen coins. They have executed transfers from the largest vaults systematically, starting with the most substantial holdings. As part of these movements, Galaxy discovered a previously unidentified vault likely containing yet another victim’s stolen resources, although the specifics surrounding that loss remain unverified.
Impact of the Coldcard Exploit
In total, the Coldcard exploit now ranks as the third-largest cryptocurrency heist reported in 2026, following the Kelp DAO hack that amounted to $293 million and the Drift protocol exploit totaling $280 million, according to data from DefiLlama. This ongoing investigation underlines the persistent challenges of crypto security and the importance of robust protective measures for digital asset holders.
