Investigators tracking the Coldcard wallet vulnerability have detected fresh movement of stolen Bitcoin through a privacy mixer. While a separate attacker has begun obscuring roughly 64 BTC via Wasabi Wallet, the largest known theft cluster remains untouched.
1,159 BTC Still Unmoved
Galaxy Research linked the biggest theft to approximately 1,159 BTC held across seven attacker-controlled addresses. The attacker consolidated the funds within about 41 minutes of the exploit and has not sent them to exchanges, mixers, or other identifiable services since then.
Bitcoin’s protocol cannot freeze flagged addresses, so the funds remain spendable. However, converting such a large balance could expose the attacker. Exchanges, law enforcement agencies, and blockchain analytics firms are reportedly tracking around 600 addresses connected to the broader exploit.
Separate Attacker Moves 64 BTC Through CoinJoin
Analysts identified another attacker attempting to obscure approximately 64 BTC using Wasabi Wallet’s CoinJoin feature. About 10 BTC entered an initial mixing transaction, while roughly 54 BTC returned as change. The remaining Bitcoin later moved into outputs of about 7 BTC each, apparently for further mixing.
CoinJoin combines multiple inputs and outputs, making direct links harder to establish. Still, timing patterns, output sizes, later consolidations, and exchange deposits can reveal useful clues for investigators.
Exploit Scale and Affected Seed Phrases
Galaxy Research estimates confirmed losses near 1,596 BTC. A suspected additional attack wave could raise the total to about 2,055 BTC, while other researchers have placed losses above 1,800 BTC.
The vulnerability affected seed phrases created with weakened random-number generation. Firmware updates prevent new vulnerable seeds, but they cannot repair seed phrases already exposed. Affected users must create a new wallet seed and move their Bitcoin. Coldcard also destroyed remaining vulnerable inventory and urged users to generate fresh seeds.
South Korean Users Avoided Major Losses
South Korea’s Bitcoin community reported virtually no direct losses despite many experienced holders using Coldcard devices. Analyst Koji Higashi linked that outcome to local self-custody practices: community leaders had promoted independent entropy generation instead of relying solely on one hardware wallet manufacturer.
Local guides described 128 coin flips for 12-word seeds and 256 coin flips for 24-word seeds. Some users converted binary results using hardware calculators rather than phones, adding another layer of protection against compromised random-number generators.
Key Takeaways
- The 1,159 BTC connected to the largest Coldcard attacker remains unmoved since consolidation.
- A separate attacker has routed about 64 BTC through Wasabi Wallet CoinJoin transactions.
- Confirmed losses stand at roughly 1,596 BTC, with possible totals exceeding 2,000 BTC.
- Firmware updates cannot secure already exposed seed phrases; affected users must migrate to new wallets.
- Independent entropy generation helped many Korean users avoid direct losses.
Leave a Reply