Coldcard Attacker Still Holds 1,159 BTC - Why the First Mixer Move Matters Now

The 1,159 BTC Hoard Still Has Not Moved

This story is back in focus because the silence around 1,159 BTC across seven addresses is now being tested against a new development. Earlier this week, analysts spotted a separate attacker beginning to route smaller amounts through a mixer. The larger stash, however, still has not entered a mixer or moved to an identifiable cash-out service.

Why the funds have stayed idle

The core issue is technical, not mysterious. Investigators tied the July 30 sweep to a Coldcard firmware flaw where seed generation was routed to a deterministic software pseudorandom number generator instead of the hardware RNG. That allowed an attacker to test candidate seeds offline against public chain data. The attack also had a clear automated fingerprint: every transaction used an identical 30 sat/vB fee rate and left no change output during the sweep.

Why traders are watching again

The main market debate is straightforward. If liquidation attempts stay limited to smaller lots, the direct sell pressure may remain contained. If those attempts widen or become more sophisticated, tagged coins can create more liquidity friction across exchanges and other off-ramps. The key point is that Bitcoin cannot be locked at the protocol level, so the risk is not just a sudden dump. It is the slow erosion of clean exit routes.

The Mixer Activity Signals Intent, Not Immediate Sell Pressure

What changed

A separate attacker appears to be testing exits. Analysts traced 64 BTC entering a mixer, but the first pass was clumsy: only about 10 BTC was mixed initially, while about 54 BTC returned as change. That remainder was later split into roughly 7 BTC outputs for additional mixing. In market terms, this looks more like a probe than a flood.

What has not changed

The largest cluster is still dormant. It has not moved to an exchange, mixer or other cash-out service. That keeps the biggest supply overhang out of the market for now, even as the separate mixing attempt shows that at least one actor is trying to build a spendable trail.

Why this matters for price discovery

The risk is not an immediate liquidation of the full stolen pile. It is the possibility that small, repeated laundering attempts make tagged Bitcoin harder to move cleanly. If more attacker wallets join the effort, or if the same attacker sharpens the process, traders may start feeling liquidity friction before any large sale becomes obvious.

What Would Turn This From Noise Into Real Sell Pressure?

The job now is to separate process from noise.

What to watch

Watch sequence, not just movement. A mixer probe matters more if it evolves from a messy test into cleaner routing toward an exchange, mixer or other identifiable cash-out service. For now, the main hoard is still unmoved, and the separate mixing attempt is still visibly rough, with unusually large outputs that remain easy to follow.

The basic mechanism is simple: Bitcoin cannot be locked at the protocol level, so flagged coins can still move. But once funds approach a regulated exchange, compliance checks can slow the exit and make clean liquidity harder to access. The real threat is not motion by itself; it is motion that shifts from on-chain obfuscation toward a usable off-ramp.

Clean watchpoints

• Process progression: repeated mixing, cleaner branching, and routing toward other cash-out service types.
• Contagion: more attacker wallets join the effort while the largest cluster remains untouched across seven addresses.
• Friction working: activity stays fragmented, tagged, and easily traceable.
• Invalidation test: the near-term cash-out risk weakens if the main hoard stays still and the mixer trail dries up without connecting to a usable exit path.

Why the firmware fix still matters

There is also a supply-side factor. fixed firmware is now available for every affected model. If affected users generate a new seed and move funds off compromised addresses, one potential source of future unauthorized spending is removed before it can reach the market.