Coldcard Attacker Moves 45% of Stolen Bitcoin

An attacker who exploited a vulnerability in Coldcard hardware wallets has moved 45% of the approximately 1.8 Bitcoin (BTC) stolen in the third wave of attacks, according to blockchain analysis firm Galaxy. This movement represents a significant portion of the funds acquired through the exploit, which targets a specific vulnerability in the device's firmware. The total amount stolen across all identified Coldcard attacks is approximately 1.8 BTC, with the third wave accounting for a portion of this total. Galaxy's analysis indicates that 82% of the Bitcoin stolen across all Coldcard attacks remains in the original addresses, suggesting that the majority of the illicitly obtained funds have not yet been laundered. However, 18% of the total stolen Bitcoin has been moved in apparent laundering attempts, with the latest movement by the third-wave attacker being the most substantial to date. The vulnerability, first disclosed in late 2023, allows an attacker to extract the private keys from a Coldcard device under specific physical and environmental conditions. This has raised significant concerns within the cryptocurrency security community regarding the integrity of hardware wallets, which are typically considered the most secure method for storing digital assets. Coldcard, a popular brand of air-gapped hardware wallets, has been working to address the disclosed vulnerabilities. The company has previously released firmware updates aimed at mitigating such risks. The ongoing exploitation of these devices highlights the persistent challenges in securing digital assets against sophisticated attack vectors. The specific details of the third-wave attack and the subsequent movement of funds are being closely monitored by security researchers and law enforcement agencies. The total value of the stolen Bitcoin fluctuates with market prices, but at current rates, 1.8 BTC represents a substantial sum. The ability of an attacker to move nearly half of the stolen funds in this latest incident underscores the urgency for both hardware wallet manufacturers and users to remain vigilant and implement robust security practices. Further analysis by Galaxy and other blockchain security firms is expected to shed more light on the attacker's methods and the potential for recovering the stolen assets. The incident also prompts a broader discussion about the evolving landscape of cryptocurrency security and the continuous arms race between exploiters and defenders in the digital asset space. The specific addresses involved in the movement of these funds are publicly visible on the Bitcoin blockchain, allowing for ongoing tracking and analysis.