Coldcard hacker moves $1.94 million in stolen bitcoin

A wallet linked to the Coldcard hardware-wallet exploit moved 30.185 bitcoin, worth about $1.94 million, to a newly created address, according to on-chain tracker Lookonchain. The transfer is the first activity from the attacker's holdings since the theft, which drained more than $130 million in bitcoin from Coldcard users through a firmware vulnerability disclosed in late July. The amount moved is a small fraction of the total stolen.

Coinkite, the wallet's maker, has said its own code review failed to catch the flaw before it shipped, and the stolen funds had sat largely untouched in the weeks since, with on-chain analysts watching the addresses for signs the attacker intends to cash out.

The bulk of the stolen bitcoin still sits unmoved, so one transfer this size says more about the attacker's patience than about any change in Coldcard's exposure.