Coldcard Hackers Move $4.55M in BTC and ETH to Mixers

Key Point

Coldcard exploit-linked wallets transferred 64 Bitcoin and 200 Ether to cryptocurrency mixing protocols. CertiK said the Bitcoin transfer went to Wasabi on Tuesday. CertiK said the Ether transfer went to Tornado Cash on Wednesday. Galaxy Digital said the Coldcard exploit drained at least $100 million in Bitcoin across three confirmed attack waves from 7,300 victim wallets. TRM Labs said most victim funds were still pooled in a small number of attacker-controlled addresses with limited mixing attempts.

Why it matters: Mixing may reduce recovery odds when stolen funds move from traceable attacker wallets into privacy-focused transaction pools.

Market Sentiment

Bearish, Stress-on, Event-driven, De-risking.

Reason: Stolen Coldcard exploit funds moved into cryptocurrency mixers, which can make asset recovery harder.

Similar Past Cases

In the Ronin Bridge case, Sky Mavis raised $150 million to reimburse users after the bridge hack affected users of Axie Infinity. The difference is that Ronin involved a bridge exploit, while Coldcard involves wallet-seed weakness and multiple suspected attackers. (Axios)

Ripple Effect

Stolen-fund mixing can weaken on-chain recovery paths and may push security teams to prioritize wallet clustering over direct asset tracing. If more pooled funds enter mixers, then recovery expectations may fall and affected users may wait longer for confirmed remediation.

Opportunities & Risks

Opportunities: If TRM Labs or Galaxy Digital identifies more attacker-controlled addresses, then affected users can monitor whether recovery coordination improves.

Risks: If more stolen funds move into mixers, then tracing confidence may decline and downside risk may remain elevated for affected wallet users.