W3BStation
Markets
BTC $96,420 +2.34% ETH $3,280 +1.82% SOL $185.40 -0.92% BNB $642.50 +0.45% XRP $2.18 +3.12% DOGE $0.082 -1.50% ADA $1.05 +0.80% AVAX $42.10 +1.15%
BTC $96,420 +2.34% ETH $3,280 +1.82% SOL $185.40 -0.92% BNB $642.50 +0.45% XRP $2.18 +3.12% DOGE $0.082 -1.50% ADA $1.05 +0.80% AVAX $42.10 +1.15%
09/08/2026

Coldcard Exploiter Moves $7.7M in Bitcoin Using THORChain and CoinJoin

What happened: The attacker behind the Coldcard hardware wallet exploit moved 97.

Coldcard Exploiter Moves $7.7M in Bitcoin Using THORChain and CoinJoin

What happened: The attacker behind the Coldcard hardware wallet exploit moved 97.09 BTC (about $7.7 million), nearly half of the third wave of stolen funds, over five days. The attacker swapped 20.5 BTC to ETH via THORChain and used CoinJoin for further obfuscation. The exploit stems from a firmware bug introduced in March 2021, which reduced seed entropy to as low as 40 bits. Most of the total 1,806 BTC ($143.9 million) stolen across all waves remains unmoved.

Why it matters: The methodical draining of 293 multisig vaults in order of size suggests the attacker is patient and organized, not acting out of panic. The exploit exposes long-term risks in hardware wallet design and highlights the importance of independent randomness in seed generation. Owners of affected wallets must regenerate their seeds, as the vulnerability cannot be patched retroactively.

Source: Decrypt