Coldcard Attacker Moves $7.7M in Bitcoin, Shifting 45% of Stolen Funds

Market impact: mildly bearish for BTCUSD in the short term, but primarily through sentiment and potential supply overhang rather than immediate selling pressure.

The transfer of 97.09 BTC, valued at approximately $7.7 million, is not by itself large enough to materially alter Bitcoin’s market balance. However, routing through THORChain and CoinJoin indicates an active effort to obscure the funds’ origin, increasing the probability that additional coins could eventually reach liquid markets or over-the-counter counterparties. The transactions should not be treated as confirmed selling: movement and laundering are not equivalent to liquidation.

The more important market variable is the remaining inventory. Galaxy’s estimate that roughly 82% of the stolen Bitcoin remains in attacker-controlled addresses creates an ongoing latent-supply risk. Future transfers from the largest vaults could trigger short-lived BTC weakness if traders anticipate exchange deposits, while confirmed deposits to identifiable exchanges would have a more direct bearish impact.

The discovery of a potentially additional vault and an estimated total exposure of about 1,806 BTC expands the perceived scale of the incident. That is more relevant for risk appetite and crypto-security sentiment than for Bitcoin’s fundamental valuation: it may temporarily increase caution toward self-custody, hardware-wallet providers, and smaller crypto assets, while encouraging monitoring of illicit-flow controls and exchange compliance actions.

Time horizon:

• Short term: bearish headline risk, particularly around each new movement or exchange-linked address.
• Medium term: impact depends on whether the remaining coins are dispersed, frozen, or converted into marketable assets.
• Longer term: limited effect on Bitcoin fundamentals unless the incident prompts broader regulatory or custody concerns.

Traders should monitor whether subsequent transfers move to centralized exchanges, stablecoin or fiat off-ramps, or remain within mixers and cross-chain routing infrastructure. Exchange deposit activity, wallet-label updates, and any recovery or freezing measures are the key confirmation points. Without that evidence, the immediate directional impact remains negative but limited and uncertain.