Coldcard Bitcoin Exploit: Latest Theft and Laundering Update

A hacker who exploited a critical flaw in Coldcard hardware wallets has started moving stolen funds through cross-chain swaps and privacy mixers, according to blockchain analytics firm Galaxy Research. The Coldcard Bitcoin exploit, which has drained roughly 1,789 BTC from thousands of addresses since late July, is now entering a new and more troubling phase: the laundering stage.

Key takeaways

• An attacker exploited a Coldcard firmware bug to steal approximately 1,789 BTC starting July 30, 2026, according to Galaxy Research.
• At least 15 different attackers took part across multiple waves between July 30 and August 6.
• The Wave 3 hacker has laundered about 97.09 BTC (roughly $7.8 million) through THORChain and CoinJoin over five days, or about 45% of that wave’s stolen funds.
• Overall, 82% of all stolen Bitcoin remains parked in attacker-controlled wallets, while only 18% has moved in a way consistent with laundering.
• The root cause was a March 2021 Coinkite firmware bug that weakened wallet seed randomness, allowing offline brute-force attacks on private keys.

Coldcard Firmware Vulnerability and Bitcoin Theft

The entire episode traces back to a coding error that sat undiscovered for years before attackers found a way to weaponize it. Coinkite, the maker of Coldcard hardware wallets, shipped a firmware update in March 2021 that inadvertently broke how the devices generated wallet seeds, and that single bug is what made the recent theft possible.