Coldcard Exploit Tops $100M as Expert Says Stolen BTC May Be Hard to Spend

Well over $100 million worth of Bitcoin has been stolen through the ongoing Coldcard wallet exploit, according to Galaxy Research. However, market commentator Joe Consorti argues that the attacker may struggle to spend most of the haul, as every stolen Bitcoin is visible on the public blockchain and tracked by law enforcement, exchanges, and blockchain analysts.

“The thief who stole $100 million in BTC is going to have a hard time spending most of it,” Consorti wrote on X. “Every coin is sitting in plain sight, tracked by Galaxy, the FBI, and thousands of others.” He added that Bitcoin “might be the worst money for crime ever invented.”

The exploit stems from weak seed phrase generation in Coldcard firmware released after March 2021, which produced seeds with only 72 bits of entropy instead of the intended 128 bits. Galaxy Research has identified 1,596 BTC stolen across roughly 7,300 addresses in three confirmed attack waves. If suspected activity is included, losses could reach 2,055 BTC, worth over $130 million. About 90% of the stolen Bitcoin has not been moved, and all coins from the first three waves remain in wallets controlled by the attacker. Galaxy has shared confirmed attacker addresses with US law enforcement, crypto exchanges, and blockchain investigation firms.

Despite the theft, Bitcoin traded near $64,000 at the time of writing, up 2% in the last 24 hours, which Consorti cited as evidence that the market distinguishes the protocol’s security from the wallet software failure.

Coinkite, the company behind Coldcard, has patched newer firmware but cannot fix seeds already generated on vulnerable devices. It advised users of Mk3, Mk4, Mk5, and Q models to move funds to unaffected hardware.

The debate over whether the stolen funds can be laundered continues. Some commentators suggest the attacker could use privacy tools like mixers, privacy-focused coins, Taproot transactions, or the Lightning Network to obscure the trail. Others, like crypto commentator Shagun, argue that blockchain analytics and compliance checks make moving such a large amount far more difficult than stealing it, and advise the attacker to return the funds for a negotiated bounty.

Source: https://cryptopotato.com/coldcard-exploit-tops-100m-as-expert-says-stolen-btc-may-be-hard-to-spend/