CertiK: $4.17 Million Bitcoin From Coldcard Heist Hit Wasabi Mixer

CertiK spotted another mixer transfer from the Coldcard exploit

CertiK identified 64 Bitcoin, worth $4.17 million and 200 Ether, worth $380,000, sent to mixing protocols in connection with the Coldcard exploit. The Bitcoin transfer was routed to Wasabi, while the Ether went to Tornado Cash. For a case that already involved large-scale theft, that matters because mixer activity suggests some of the stolen funds are still being layered, which can complicate tracking and recovery.

This transfer should be read alongside the broader theft. Galaxy Research said hackers had already moved about 1,816 Bitcoin, worth nearly $116 million from Coldcard wallets across more than 5,200 addresses. The immediate question is no longer whether the original breach occurred, but whether additional funds tied to the incident are still being routed through privacy tools.

Galaxy Research's rising estimates show why the scale matters

The latest mixer movement is drawing attention because the Coldcard incident quickly expanded beyond a single breach. Galaxy Research initially estimated about $70 million in less than an hour after more than 1,000 bitcoin was drained from 1,196 wallets in 41 minutes on July 30. Suspected follow-on waves later pushed that estimate to nearly $89 million.

That rapid scale helped turn Coldcard into a broader self-custody concern. The device was marketed as a bitcoin-only hardware wallet that keeps seed phrases offline, so attacks tied to it hit harder than a routine exploit. Galaxy also said hackers had drained more than $100 million US worth of bitcoin, with a suspected fourth wave potentially raising total losses to about $130 million US.

The bull case rests on mostly untouched funds; the bear case rests on trust

One reason investors have not treated the incident as an outright market dump is that most of the stolen funds still appear dormant. TRM Labs found that the majority of victim funds were still pooled in a small number of attacker-controlled addresses with limited mixing attempts. If that holds, there is still room for recovery action, or at least a lower immediate supply shock to the market.

The bearish read is different. The exploit has affected more than 5,200 individual addresses, and recent transfers linked to the incident were sent to mixers, which can reduce the odds of recovery. Coldcard was also sold as "cold" storage, so any hint that the risk is narrower than one isolated flaw but broader than a single target can weaken confidence faster than price immediately reflects it bitcoin-only hardware wallet.

What matters next: copycats, fresh outflows, and whether the flaw stays narrow

CertiK said "it might be a smaller exploiter. There's likely a few copycats after the initial exploit". That makes the next phase of the story less about the original breach and more about whether similar wallets are being targeted and whether stolen funds continue to move.

What investors should watch

• New outflows from known attacker wallets. Galaxy said hackers had already moved about 1,816 bitcoin; fresh transfers would suggest monetization is still ongoing.
• Additional deposits to mixers or privacy routes. CertiK tied recent exploit-linked funds to Wasabi and Tornado Cash.
• More reports of similar Coldcard drains. Galaxy flagged suspected additional attacks, and coverage has focused on whether managing private keys has become too risky.

The clearest sign that the episode is narrowing would be quieter on-chain behavior: no new waves of drains, recovery efforts tied to specific firmware or usage paths, and no further movement from attacker-controlled wallets.