Galaxy

Security

Value

random

Bitcoin

<p style="text-align: justify">A <a href="https://en.coin-turk.com/bitcoins-bull-journey-understanding-current-trends-and-future-predictions/" rel="noopener noreferrer nofollow">Bitcoin</a> wallet associated with the Coldcard hardware wallet breach transferred 30.185 BTC, valued at roughly $1.94 million, to a newly created address on August 7. On-chain analytics firm Lookonchain was the first to observe the transfer, which marked the first movement of stolen funds since the initial attack.</p><h2 id="resurgence-of-hacker-activity-after-long-silence">Resurgence of hacker activity after long silence</h2><p style="text-align: justify">The transfer accounted for about 1.5% of the estimated 2,055 BTC stolen in the attack. Prior to this movement, the majority of the stolen assets had remained untouched, according to data from Galaxy Research. This latest activity gives analysts renewed insight into how the attacker is handling the stolen funds and where they might be sent next.</p><p style="text-align: justify">Galaxy Research, a digital asset research firm, previously confirmed that three distinct attacks resulted in the loss of 1,596 BTC from over 7,300 wallet addresses. Should a fourth attack take place, total losses could climb to nearly 2,055 BTC—worth approximately $130 million at the current rate.</p><p style="text-align: justify">Coldcard, manufactured by Coinkite, is a hardware wallet designed to add an extra layer of security for storing Bitcoin private keys. A flaw discovered in its firmware has put funds at significant risk.</p><p style="text-align: justify;background: linear-gradient(135deg,#ffffff 0%,#fffdf9 100%);border:1px solid #f1e4d8;border-left:4px solid #F69434;padding:14px 16px;border-radius:12px;color:#1e293b;font-size:15px;line-height:1.7">Mini dictionary: Coldcard, a hardware wallet produced by Coinkite, is a specialized device used to securely store cryptocurrency private keys offline, providing enhanced protection against cyberattacks.</p><h2 id="security-flaw-and-user-risks">Security flaw and user risks</h2><p style="text-align: justify">The vulnerability that allowed the breach stemmed from a deterministic pseudo-random generator used in the wallet seed creation, according to Coinkite. This flawed implementation replaced the intended hardware-based true random number generator, leaving affected wallets exposed. With seed phrases and private keys compromised, attackers gained the power to access and move users’ coins without physical access to the devices.</p><p style="text-align: justify">Coinkite notified its customers about the risk and advised those who created seed phrases with the affected firmware to transfer their holdings to new addresses and regenerate wallet seeds. While firmware updates have since been released, funds linked to the previously vulnerable seeds remain at risk until users take recommended actions.</p><h2 id="tracing-the-stolen-bitcoin">Tracing the stolen Bitcoin</h2><p style="text-align: justify">All Bitcoin movements are publicly viewable on the blockchain, enabling investigators and on-chain analysts to track the progress of stolen coins. Historically, attackers attempt to move illicit funds through multiple wallets before reaching exchanges, hoping to mask the origin and cash out. However, the latest transfer does not confirm whether a sale is imminent and the funds may sit idle or move again.</p><table style="border:1px solid #f1e4d8;padding:8px"><thead><tr><th>Event</th><th>BTC Amount</th><th>Value (Approx.)</th></tr></thead><tbody><tr><td>Total stolen</td><td>2,055</td><td>$130 million</td></tr><tr><td>Moved on Aug. 7</td><td>30.185</td><td>$1.94 million</td></tr><tr><td>Unmoved (prior to Aug. 7)</td><td>~2,025</td><td>~$128 million</td></tr></tbody></table><p style="text-align: justify">Galaxy Research reported that it has shared detailed information about attacker and victim wallet addresses with US law enforcement, major cryptocurrency exchanges, and cybercrime units. This collaboration aims to support ongoing monitoring and potential identification of those responsible.</p><blockquote><p>Coinkite alerted customers who created seed phrases on the affected firmware, urging them to move funds to secure wallets and update to the latest software for continued protection.</p></blockquote><p style="text-align: justify">As attention now shifts to the newly activated address, analysts will monitor subsequent Bitcoin movements in hopes of uncovering more about the attacker’s strategies or attempts to liquidate stolen assets.</p><p>The post <a href="https://en.coin-turk.com/coldcard-hacker-moves-30-btc-worth-1-94-million-after-months-of-inactivity/" rel="noopener noreferrer nofollow">Coldcard hacker moves 30 BTC worth $1.94 million after months of inactivity</a> appeared first on <a href="https://en.coin-turk.com" rel="noopener noreferrer nofollow">COINTURK NEWS</a>.</p>

Coldcard hacker moves 30 BTC worth $1.94 million after months of inactivity

Table of Contents

COINTURK NEWS

Other articles published on Aug 8, 2026

Cardano (ADA) capped at $0.20: What the charts say about the next move

Cardano surges above key support as first IBC bridge with Injective goes live

BNB Price Tests $602 Resistance as Bullish Momentum Builds

Euro’s Rebound Against US Dollar Faces Key Cloud Barrier – UOB

Household lending gains momentum across Central and Eastern Europe

Oil and Gold Price Outlook: Key Levels and Market Drivers for the Week Ahead

Join our free newsletter for daily crypto updates!