Coldcard hacker moves $7.7 million in BTC, 45% of bitcoin stolen in third attack wave

Market impact: bearish for BTCUSD, but likely limited at the aggregate market level.

The immediate concern is not the approximately 97 BTC moved, which is relatively small versus Bitcoin’s overall liquidity, but the possibility that the attacker is transitioning from dormant holdings to liquidation. Routing funds through THORChain and CoinJoin increases the probability of eventual conversion into other assets or fiat, creating a potential—though difficult to quantify—source of spot selling pressure. CoinDesk’s page displayed BTC at approximately $79,400.57, down 0.61%, but the article does not establish that the theft-related transfers caused that move.

The more important market risk is the remaining inventory overhang. Galaxy Research estimates that roughly 82% of the stolen bitcoin remains at attacker-controlled addresses. If the attacker continues emptying vaults in size order, additional blockchain alerts could trigger short-term risk reduction, particularly among leveraged traders, even before any coins reach exchanges. The next ten vaults reportedly contain only about 30.81 BTC, while the broader exploit is estimated at roughly 1,806 BTC, so the direct supply impact remains manageable but could become more significant if a large share is liquidated rapidly.

The event is more negative for crypto custody and security sentiment than for Bitcoin’s long-term supply-demand balance. The compromised seed-generation process and the requirement for affected users to create new seeds undermine confidence in hardware-wallet security and may weigh on custody providers, wallet manufacturers, and related crypto infrastructure. This could temporarily favor exchange-held liquidity over self-custody, although that interpretation would be adverse for the sector’s broader security narrative.

Key scenarios:

• Bearish: Further large transfers, exchange deposits, or identifiable swap activity could produce episodic BTC selling pressure and amplify liquidation risk.
• Contained: If the coins remain in CoinJoin or cross-chain infrastructure without evidence of exchange sales, the impact should remain primarily sentiment-driven and short-lived.
• Broader risk-off: Confirmation that additional Coldcard vaults are compromised could extend the effect across hardware-wallet and decentralized-finance assets, while increasing scrutiny of cross-chain laundering routes.

Traders should monitor blockchain movements from the remaining attacker addresses, exchange or OTC deposit signals, continued vault-draining activity, and any confirmation from Coinkite or security researchers regarding the scope of the firmware flaw. The key distinction is whether transferred BTC is merely being obfuscated or is entering the market for liquidation.