Coldcard Attackers Move 45% of Stolen Bitcoin Through Mixers and Bridges
The Coldcard attack remains active, with attackers moving about 45% of the stolen Bitcoin through Ethereum bridges and CoinJoin mixing transactions. The Wave 3 operation reportedly created 293 separate 2-of-2 multisignature vaults for victims and has so far processed the 11 largest vaults by value.
The next 10 vaults contain a combined 30.81 BTC, while vaults ranked 61 to 293 hold another 33.77 BTC. Blockchain analysts also identified a previously unknown vault with 58 addresses using the same 2-of-2 multisignature structure. It may be linked to a Coldcard victim, potentially increasing the number of affected vaults to 294.
If confirmed, the discovery could raise the estimated total stolen in the Coldcard attack to about 1,806 BTC. Funds have been routed through THORChain to Ethereum or into CoinJoin transactions, making attribution and recovery more difficult. Traders should monitor BTC movements from related wallets, mixer activity and potential exchange deposits, although the transfers do not currently represent a broad market fundamental change.
Bearish
The expected market impact is bearish, but likely limited and concentrated in Bitcoin-related sentiment rather than the entire crypto market. The movement of roughly 45% of the stolen BTC increases the risk of future selling if the attackers route funds to exchanges or over-the-counter markets. Large wallet transfers can also trigger short-term volatility and risk-off behavior, particularly when blockchain monitoring services flag deposits linked to a major exploit.
The use of THORChain and CoinJoin makes the funds harder to trace and raises concerns about money laundering, exchange compliance and possible wallet freezes. Similar historical hack-related sell-offs have often produced temporary pressure when stolen assets reach exchanges, while transfers between private wallets or mixers have had a smaller immediate price effect.
For short-term traders, on-chain alerts, exchange inflows and BTC liquidity are the main indicators to watch. If no significant exchange deposits occur, the direct price impact may remain limited. Over the longer term, the incident could increase scrutiny of hardware-wallet security, multisignature custody and cross-chain bridges. It may also reinforce regulatory pressure on mixers and privacy-enhancing transaction services. The classification is therefore bearish because of the potential supply overhang and negative security sentiment, although it is not evidence of a broad systemic market failure.