Coldcard Hack Attackers Move Millions in Bitcoin and Ether Through Crypto Mixers

Hackers linked to the Coldcard wallet exploit have begun sending stolen funds through cryptocurrency mixing services, according to blockchain security firm CertiK, even as most stolen assets remain sitting in traceable wallets.

Funds Sent to Mixing Platforms

Around 64 Bitcoin, worth about $4.17 million, and 200 Ether, worth close to $380,000, were moved into mixers this week. The Bitcoin went to Wasabi on Tuesday, while the Ether was routed through Tornado Cash on Wednesday. A CertiK spokesperson suggested this may be a smaller, copycat attacker rather than the original hacker, noting several copycats appear to have followed the initial breach.

One of 2026’s Biggest Hacks

The Coldcard exploit is now the third-largest crypto hack of the year, with Galaxy Digital reporting at least $100 million in Bitcoin drained across three attack waves affecting 7,300 wallets. A suspected fourth wave could push losses to $130 million.

Root Cause and Multiple Attackers

TRM Labs traced the flaw to a 2021 firmware bug that weakened key strength, making wallets brute-forceable without physical access. Differences in attack patterns suggest at least 15 separate attackers, according to Galaxy Digital.