Coldcard hacker drains 11 vaults, moves $7.7M in third attack wave

The attacker behind the $114 million bitcoin theft from Coldcard has now drained the 11 largest vaults linked to the third attack wave, moving roughly $7.7 million — about 45% of the bitcoin stolen in that wave to new wallet addresses, according to Galaxy Research.

The movement comes about three weeks after Coldcard shipped new firmware following a security review, a fix prompted by the thefts. Updates addressed the original flaw and surfaced unrelated bugs, though Coldcard warned that updating a compromised wallet still does not make it safe, and the attacker continues to liquidate stolen funds.