Someone just siphoned 1,159 BTC from Coldcard hardware wallet users. The money sits untouched across seven addresses, but that calm won't last long. A second attacker already started moving 64 BTC through mixers, with roughly 10 BTC partially laundered so far.
The Coldcard breach spread across multiple victims over several months. Investigators flagged around 600 addresses connected to the thefts, tracking the flow of stolen coins as attackers weigh their next moves. The largest haul remains dormant for now, which gives forensic teams a window to monitor what happens next.
The Mixing Game Begins
One attacker chose speed over caution. That 64 BTC moved quickly toward mixing services, a sign they're rushing to obscure the funds before exchanges or law enforcement can freeze accounts. Ten Bitcoin made it through the tumbler already, a test run that suggests the full amount could follow within days or weeks.
The main attacker shows more patience. Holding 1,159 BTC without touching it is either strategic waiting or a sign they haven't figured out how to cash out quietly yet. Either way, it's a fortune that would fetch roughly $75 million at current prices. Security teams are watching those seven addresses like hawks, ready to flag any movement toward exchanges or services that could convert the coins to fiat currency.
This story covers theft and blockchain analysis, not investment advice. Crypto security remains evolving, and users should verify hardware wallet software from official sources only.
