A wallet linked to the Coldcard theft moved 30.185 BTC worth about $1.94 million as analysts continue tracking the stolen funds.

A Bitcoin wallet linked to the ongoing Coldcard theft moved 30.185 BTC, worth approximately $1.94 million, to a newly created address on August 7, according to blockchain data reported by CryptoNews and tracked by Lookonchain.

The wallet had reportedly remained inactive for several weeks before the latest transaction, bringing renewed attention to the movement of Bitcoin associated with the Coldcard incident.

The transfer represents around 1.5% of the estimated 2,055 BTC potentially connected to the theft. However, that figure remains an estimate rather than a confirmed total. Galaxy Research previously identified 1,596 BTC linked to approximately 7,300 addresses, while a suspected fourth wave of affected wallets could bring the estimated total to around 2,055 BTC.

Other blockchain investigations have produced different estimates. TRM Labs, for example, identified approximately 1,816 BTC worth around $116 million across more than 5,200 addresses in its analysis of the incident. The figures remain subject to further investigation as researchers continue identifying potentially affected wallets.

The Coldcard incident is linked to a firmware vulnerability dating back to March 2021. According to security researchers, affected Coldcard devices could use a deterministic software pseudorandom number generator instead of the intended hardware-based source of randomness when generating wallet seeds.

The weakness meant that attackers could potentially reconstruct or brute-force the private keys associated with vulnerable wallets without needing physical access to the Coldcard devices.

The latest Bitcoin transfer does not, by itself, establish that the funds are being sold or converted into other assets. The destination address was newly created, and blockchain analysts are continuing to monitor its activity.

Attribution also remains uncertain. While blockchain researchers have linked the addresses to the Coldcard theft, the available analysis does not conclusively identify the individual or group controlling the wallet. TRM Labs has noted that multiple attackers could potentially be involved in the wider campaign.

Previous activity associated with the theft has included the movement of funds through additional addresses and cryptocurrency services. However, the latest 30.185 BTC transaction should not be interpreted on its own as evidence that a cash-out operation is underway.

The incident has become one of the largest known hardware-wallet-related cryptocurrency thefts reported in 2026, highlighting the consequences that can arise from weaknesses in wallet seed generation.

As blockchain researchers continue mapping affected addresses, the public nature of the Bitcoin network allows investigators to follow the movement of funds even when the identities behind the wallets remain unknown.

Source : Crypto News and TRM Labs

Related articles :

__Reports are sourced from official documents, law-enforcement updates, and credible investigations.

Discover additional reports, market trends, crime analysis and Harm Reduction articles on DarkDotWeb to stay informed about the latest dark web operations.__

Coldcard-Linked Wallet Moves $1.94M in Bitcoin