Signal
Coldcard attacker moves $7.7 million in Bitcoin
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-09-07 09:36 UTCUpdated 2026-09-07 11:10 UTC
rsstelegram
cryptobitcoinsecurityon_chainstolen_funds
Trend in the last 24h
Current brief openSource links open
This current signal is open on the public brief with summary, metadata, source links, and full evidence. Pro adds compare-over-time, alerts, exports, and workflow.
No card needed for the free brief.
Evidence trail (top sources)
top sources (2 domains)domains are deduped. counts indicate coverage, not truth.2 top sources shown
limited source diversity in top sources
Overview
Reports describe continued movement of Bitcoin stolen in the Coldcard attacks. The attacker reportedly created 293 separate vaults and is emptying them by size, while Cointelegraph cites Galaxy’s estimate that 18% of Bitcoin stolen across the attacks has moved in apparent laundering.
Entities
GalaxyColdcardBTC
Why now
- Reports say the attacker is currently emptying the vaults by size.
- The latest coverage identifies $7.7 million in movement from the third-wave haul.
Why it matters
- Movement of stolen BTC can provide a fresh on-chain monitoring signal for exchanges and investigators.
- The reported transfers concern funds linked to multiple Coldcard attacks.
Evidence assessment
Recurring claims
- The attacker reportedly moved $7.7 million in Bitcoin, nearly half of the third-wave haul, after creating 293 separate vaults.
- Galaxy reportedly assessed that 82% of Bitcoin stolen across all Coldcard attacks remained in the original addresses, while 18% had moved in apparent laundering.
How sources frame it
- Decrypt: neutral
- Cointelegraph: neutral
Fresh reports track the movement of Bitcoin linked to the Coldcard attacks, with overlapping coverage from Decrypt and Cointelegraph.
All evidence
All evidence
Decrypt report on the Coldcard hacker’s Bitcoin movements
decrypt.co · decrypt.co · 2026-09-07 11:09 UTC
Cointelegraph report citing Galaxy’s assessment
cointelegraph.com · cointelegraph.com · 2026-09-07 09:36 UTC
Show filters & breakdown
Evidence items loaded: 0Publishers: 2Origin domains: 2Duplicates: -
Showing 2 / 3