The hackers behind the Coldcard exploit have shifted 64 bitcoin and 200 ether to cryptocurrency mixers, according to on-chain data. The transfer, which took place this week, is an attempt to launder the stolen funds. However, most of the assets remain traceable in wallets still controlled by the attackers.
Hackers shift loot to mixers
Blockchain analysts spotted the movement of funds from known Coldcard exploit wallets to several mixing services. The transactions involved 64 BTC and 200 ETH, sent in multiple batches over the past 48 hours. Mixers are designed to break the link between sender and receiver by pooling funds from many users, but in this case the trail hasn't gone cold.
Most stolen crypto still visible
Despite the use of mixers, the majority of the stolen funds remain in wallets that investigators can track. The attackers have not yet moved the bulk of the haul — estimated at over 1,200 BTC and 4,000 ETH from the original exploit. This suggests the laundering process is still in its early stages, or that the hackers are struggling to obfuscate the larger sums.
No clear end to the investigation
Law enforcement and blockchain forensics firms continue to monitor the wallets. The Coldcard exploit, which targeted hardware wallet users, was one of the larger thefts this year. While the mixer usage complicates recovery, the fact that most funds remain traceable gives investigators a window. The next concrete step will be watching for further transfers — and whether the hackers attempt to cash out through exchanges that require KYC.
