Coldcard Hackers Move 45% of Stolen Bitcoin

A third-wave attacker linked to the Coldcard theft has moved 45% of the bitcoin associated with that tranche, according to Galaxy. The movement adds another data point to a broader pattern of post-theft wallet activity that investigators have been tracking across the incident.

Galaxy said 82% of bitcoin stolen across all Coldcard attacks remains in the original addresses, while 18% has been moved in apparent laundering. That split suggests the majority of the funds have not yet been dispersed, but a meaningful share has already entered a movement phase that can complicate tracing and recovery efforts.

The latest transfer does not, by itself, establish a liquidation event. Still, when stolen bitcoin begins to move after a period of dormancy, analysts often treat the activity as a sign that the holder is preparing to fragment the funds across additional wallets, mixers, bridges or exchanges. Each step can reduce visibility and raise the operational burden for investigators and compliance teams.

For market participants, the direct price impact remains limited unless the stolen coins reach venues with sufficient liquidity to absorb them. Even so, the episode reinforces a persistent risk in crypto markets: security failures can create latent supply overhangs that surface long after the original breach.

The broader backdrop is one of elevated risk appetite, with the Fear and Greed Index at 71. In that environment, isolated security headlines can still trigger short-lived caution, particularly if they involve bitcoin and raise questions about exchange inflows, wallet clustering or potential sell pressure.