An attacker tied to the Coldcard third-wave hack moved 45% of the stolen Bitcoin on Monday, shifting roughly $7.7 million worth of the cryptocurrency. The transfer, recorded on 7 September 2026, is the largest single movement of funds from the breach since it was disclosed.
The scale of the move
The transaction represents a significant chunk of the total haul from the Coldcard incident. Moving 45% in one go is not a casual shuffle — it suggests the attacker is either testing liquidity channels or preparing to launder the funds through mixers and exchanges.
Blockchain analysts tracking the wallet flagged the activity within hours. The destination addresses have not been publicly identified, and it's unclear whether the funds have been cashed out or are sitting in intermediate wallets.
What we know about the Coldcard hack
Coldcard, a hardware wallet maker popular with security-conscious Bitcoin users, disclosed the third-wave hack earlier this year. The breach compromised a subset of devices, and the attacker made off with a seven-figure sum in BTC. The company has since pushed firmware updates and urged affected customers to move funds to new wallets.
This is not the first time stolen funds from the incident have moved. But Monday's transfer is by far the biggest, and it comes as law enforcement agencies have been circling the case.
Why the timing matters
The move lands at a moment when the broader crypto market is already on edge. Large dumps of stolen coins can spook traders, and a $7.7 million sell order is enough to move the needle on some exchanges.
It also complicates recovery efforts. Once stolen Bitcoin gets mixed or passed through privacy tools, tracing it becomes exponentially harder. The fact that the attacker waited months before moving this much suggests a deliberate strategy rather than a panicked exit.
For now, the remaining 55% of the stolen funds is still sitting in the original wallet. Whether the attacker plans to move the rest in smaller chunks or in another large block is an open question — and one that investigators are likely watching closely.
