COLDCARD Seed Bug Exploit: Main Wallet Cluster Still Holds 1,159 BTC; Separate Actor Sends 64 BTC Through Mixer

A major COLDCARD exploit remains active onchain. The largest identified attacker linked to the seed-generation vulnerability is still sitting on 1,159 BTC spread across seven addresses, while a different actor has started moving smaller amounts through a mixer, giving investigators fresh transaction paths to track. Galaxy Research's monitoring shows the biggest known theft—1,159 BTC—was consolidated into seven addresses in roughly 41 minutes. Those balances have not moved since, and there have been no observed transfers from that cluster to exchanges, mixers, or common cash-out services. The funds are not "frozen" in any protocol sense, but attempts to move them into fiat rails or regulated venues would likely trip AML/KYC controls. Law enforcement, exchanges, and analytics firms have flagged about 600 addresses tied to the broader theft, raising the odds that deposits to compliant platforms draw scrutiny. Separately, analysts identified a 64 BTC flow into a mixer-linked transaction. Around 10 BTC was mixed immediately. About 54 BTC came back as change and was split into roughly 7 BTC outputs for additional mixing. Mixers aim to blur provenance by reshaping transaction flows, but they do not guarantee anonymity. In this case, the relatively large, uniform outputs may make the laundering pattern easier to follow, allowing continued monitoring of subsequent hops. The mixer activity does not appear connected to the seven-address cluster holding 1,159 BTC. Prior reporting suggested multiple attackers exploited the same COLDCARD seed-generation flaw, so movements from one cluster should not be assumed to be tied to the same actor. Galaxy Research has previously confirmed approximately 1,596 BTC was stolen in three attack waves from about 7,300 addresses, along with 14 smaller related incidents. A suspected fourth wave could push the total close to 2,055 BTC, though that figure has not been fully corroborated by victim reports. The issue traces back to a firmware bug that weakened randomness during seed-phrase creation. Attackers could generate candidate seeds offline, derive addresses, and match them to live onchain addresses—without physical device access, PINs, or any Bitcoin protocol-level compromise. Coinkite has shipped corrected firmware, but updating alone does not secure seeds created on vulnerable versions. Affected users need to generate a new seed and move funds to addresses derived from it. Galaxy has shared confirmed attacker and victim addresses with U.S. law enforcement, exchanges, and cyber-investigation groups, improving the chances of detecting attempts to route coins through regulated services. Recovery remains uncertain, as attackers can layer transfers across multiple addresses, mixers, decentralized platforms, or jurisdictions outside U.S. reach before attempting to cash out. The key takeaway: the largest known COLDCARD-related attacker is still holding 1,159 BTC that has not moved since the initial sweep, leaving those coins under continuous public surveillance. At the same time, the newer mixer activity by another actor has created a trail investigators are likely to watch closely as the case develops.