The hacker behind the Coldcard wallet exploit has transferred 97.09 BTC, valued at $7.7 million, with concerns over remaining stolen funds still unresolved.
Bitcoin Transfers from Coldcard Hack Continue
A total of 97.09 BTC, valued at approximately $7.7 million, has been transferred from the third wave of thefts targeting Coldcard hardware wallets. This was reported by Galaxy Research, which noted that the transfer took place on September 2 through THORChain and included subsequent CoinJoin transactions.
Initially, around 20.5 BTC was moved from the largest vault and converted to Ethereum, while additional transfers occurred over the weekend. Only 20.56 BTC successfully converted to Ethereum, with the remaining 57.24 BTC held as change in a CoinJoin wallet. Galaxy Research suggests that roughly 19 BTC is still unaccounted for.
"The Coldcard ‘Wave 3’ exploiter continues to transfer funds. The recent transfers are going into CoinJoin rounds," noted Galaxy Research in a recent post.
The hacker set up 293 multisig vaults for each victim, with varying amounts of Bitcoin still held in them. As of now, 11 vaults are empty while others contain BTC amounts ranging from 30.81 BTC to 33.77 BTC.
Details of the Exploit
The exploit stems from a firmware vulnerability discovered in March 2021, which compromised the strength of generated keys due to a shift from hardware to software random-number generation. This weakness enabled attackers to recreate private keys offline, thus accessing single-signature addresses without direct hardware access. The initial thefts began on July 30, and Coinkite has since released an updated firmware that addresses these vulnerabilities.
In an effort to restore user confidence, Coinkite's CEO Rodolfo Novak publicly acknowledged the issue and emphasized the need to regain users' trust. A technical analysis of the exploit is expected soon.
According to Galaxy's recent analysis, the total losses from the Coldcard exploit may be as high as 1,806 BTC or $143.9 million. Speculations suggest that a fourth wave of unverified attacks could push total losses to over 2,400 BTC, with 82% of the stolen Bitcoin still retained by the hacker.
